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LEGAL RIGHT 
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backup copy 
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Our editorial policy is that v\re do NOT condone 
softv\rare piracy, but we do believe that users are entitled 
to backup commercial disks they have purchased. 

In addition to the security of a backup disk, the removal 
of copy-protection gives the user the option of modifying 
programs to meet his or her needs. 

Furthermore, the copyright lav\rs guarantee your right 
to such a DEPROTECTED backup copy: 



...'it is not an infringement for the owner of a copy of 
a computer program to make or authorize the making of 
another copy or adaptation of that computer program 
provided: 

1) that such a new copy or adaptation is created as an 
essential step in the utilization of the computer program in 
conjunction with a machine and that it is used in no other 
manner, or 

2) that such new copy or adaptation is for archival 
purposes only and that all archival copies are destroyed in 
the event that continued possession of tlie computer program 
should cease to be rightful. 

Any exact copies prepared in accordance with the 
provisions of this section may be leased, sold, or otherwise 
transferred, along with the copy from which such copies 
were prepared, only as part of the lease, sale, or other 
transfer of all rights in the program. Adaptations so prepared 
may be transferred only with the authorization of the 
copyright owner." 



United States Code title 17, 1117 
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Why type those 
l-o-n-g listings 
when you can just 
Upgrade your 
present sub. to a 
Mag/Disk Combo 
subscription 

■ You may upgrade your current 
subscription lo a magazine & disk 
combination by sending $S.50 ($6.50 
foreign) per remaining issue. 

Time to renew? 

■ Check your mailing label to see if you 
need to renew your subscription. 

D Use the order form on this page to 
renew, and don't forget to send your most 
current mailing label to help expedite your 
renewal 

Moving soon? 

■ U you're moving, let us know at least 30 
days in advance. 

■ Issues missed due to non-t'SCiept of 
Change-of- Address may be acquired at the 
regular back issue rates. 

■ Remember, the Post Office docs not 
forward third class mail unless requested. 
COMPUTIST is not responsible for 
replacing issues lost while forwarding order 
is in effect. 
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Editorial 



Judging by the letters I've been reading, there is still a lot of confusion about RDEX both here 
and with our readers. I'm going to answer sonic of your questions here. 

■ LSttGf S to SUthOtS! We do not print our writer's addresses unless they specificaiiy 
request it. This i.s to protect them from the idiots that would waste their valuable time and from 
the crazies that would do worse. Our writers are entitled to their privacy. The unfortunate side- 
result is that reader correspondence is also blocked. There is a way for you to contact an author 
if we have their address. Write your letter and put it in an envelope addressed to the authors name 
with your full return address and correct postage. Place thi.s envelope into another envelope and 
send it to us. We will put the correct address on the envelope (providing we have one) and mail 
it from here. 

I IdSntiCctl SOftksyS! We receive a lot of softkcys, some of which look identical. 
If upon closer examination there are differences, even minor ones, we will print all versions. If 
we do not have the program in question, it is imposible to second guess the author. If one softkey 
has one more edit than another, we don't know if the first softkey is incomplete or if the second 
softkey has an extra edit or even if the two softkeys are for cJifferent versions. It's better to print 
them both and let you decide. 

While we're on the subject of softkeys I'd like to request that you include the hex bytes before 
and after the edits as a search string for those readers who may have a slightly different version. 

I BOUldOlDSSh II: Before anyone else jumps on my case, . . NO, I didn't know that 
Super BoulderDash is the same as BoulderDash II . And yes, we published a very complete softkey 
for BoulderDash I & BoulderDash II in COMPUTIST #38. 

I Pictures: when sending softkeys to RDEX on disk, please include hi-res pictures files 
from that program whenever possible. We need something for our covers and some may find their 
way inside. 

I KUDOS: Reader recommendations for qua! ity software , hardware andcxceptionalserv ice 
arc invaluable to other readers. If you have a program that you feel ranks right up there with sex 
and fine chocolate, let the other readers know. Also, if you've received something from the wrong 
end of the horse, let us know so others won't have to repeat your experience. One condition: reader 
recommendations must have a real name and address. We can't print recommendations from 
anonymous sources. 

I Starter Kit Documentation: No, there isn't any easy way to prmt the ■ 'DOC ' 
files. I suggest you load them into a text editor, delete the control characters and reformat the 
files, then use the editor to make your hard copies. 

I Previous Submissions: I still have & lot of catch-up work in the writing letters 
department. There's a pile of submissions still to be sorted, including some that were accepted 
before our editorial reorganization. If you submitted an article and have not received a letter from 
the RDEX editor, there's a good chance your material is still in that pile. I'm writing letters as 
fast as I can but there are so many folders and each requires a different letter. You can shorten 
this process by sending a letter to RDEX naming your submission and giving us permission 
to use your material in RDEX. You could probably make it into the next issue. 

I Letters to COMPUTIST; if you send material to RDEX make sure it's addressed 
to "RDEX". Letters sent to RDEX arc uploaded first. Other letters have to be evaluated and 
if the intent is not clear they are put into another "box" until a follow-up letter can be written 
requesting clarification. And you know how far behind I am in my letter writing, 

I BUGS 

■ COMPUTIST #49, Science Toolkit, page 27. Line 1020 and line 1O40 of the controller should 



read: 

1026 GOSUB 430 : GOSUB 100 : ST = ST + 1 
1040 GOSUB 430 : GOSUB 100 : ST = ST + 1 



IFST< 9 THEN 1020 
IFST<15THEN 1040 
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Commando 36 

Computer Preparation for SAT 14 

Conflict In Vietnam 11 

Counting Critters 24 

Crisis Mountain 16 

Dataquest: Fifty States 24 

*Dehae Paint 11 19 

Dino Eggs. 16 

Di.mey Card & Party Shop 18, 33 

Disney Comic Strip Maker IS 

*Draw- Plus 21, 23 

Eidolon 38 

Electric Crayon ABCs 25 

Expedition Amazon 12 

Eacemaker .40 

First Letter Fun 24 

Fish Scales 24 

Fun From A to Z 24 

Game Maker 17. +2/ 
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GEL Championship Football t/Z, 37 
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Great Road Race / 7 

Hacker II 17. 21 
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Infiltrator 11. 36 

*!nstatit Music 19 

James Bond 007: A View To A Kill 9 
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Kung Fu Master 40 
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Manic Mansion 37 
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Moebius 15 
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Music Studion 9 

Number Munchers 24 



Paint With Words 24 

*Paintworks Plus 9 

Path Tactics 24 

pfsiFile 28 

pfs:Graph 28 

pfs:Plan 28 

pfs.Report . . , , 28 

pfs:Write 28 

Phonics Prime Time 24 

Portal 36 

Principal 's Assistant 10 

*Print Shop ProDOS 8 vl.4 22, 23 

Print Shop Graphics Holiday Edition 19 

Quickflash! ' 24 

^Reader Rabbit , 9, 23 

Realm of Impossibility UO 

Robot Otefv lv.2.0...: 22 

Rocky Horror Show /7 

Rocky 's Boots \4.0 32 

Saracen 39 

*Shanghai 9, 21 

Silent Sen'ice. 30 

Skylab 24 

Sound Tracks 24 

Speedy Math ...24 

Spindizzy 12, 17 

Street Sports Baseball 36, 40 

Sub-Mission 39 

Super Boulderdash 26 

Toss Times in Tonetown 37 

*The.icder , — - 19 

Top Fuel Eliminator , 39 

Word Handler 26 

Word Munchers 24 

Words at Work 24 

World Karate Championship 14 

* Writer's Choice Elite 23 

Zardax v5.2J W 

* Apple Ilgs softkey, 

t Softkey requires some other issue of 

COMPUTIST or is incomplete as published. 

m A.V.I. IS: 

Autoduel 9 

Black Magic 7 

Commando 36 

Expedition Amazon 12 

Marble Madness 7 

Rescue Raiders , 8, 14 

Sub-Mission 40 

Super Boulderdash 7 

Sword of Kadash 8 

■iP£m|tfcg Ttpft: 

Alternate Reality 16 

Beyond Castle Wolfenste'tn.SS, 16, 18 

Coveted Mirror 10 

Randam 15 

Ultima IV 10 

World Karate Championship 14 




Editorial 4 

Bugs ....4 

Most Wanted Softkeys .40 

■ Fea£u%ed: 

APT Writer for... m, 

Super Boulderdash T 

M.A. Horton's program autoinaiically modifici, 

Super Boulderdash so that yon can get c,\tra men 
or move on to the next cave any time you want. 
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Activision software 

William Green's quick-n-easy softkeys for: Game 
Maker. Hacker II, Little Computer People , Great 
American Road Race, Spindizzy. Master of the 
l^mps. Rocky Horror Show. 

Double Your F-8 ROM Space ^ „ 

Without Motherboard Surgery A / 

Thomas Beach's hardware project doesn t 

permanently alter your motherboard. 



.23 



MECC software 

Jack Moravet^'s Super lOB cotitroller will 

completely dcprotecl Arithmetic Critters. Counting 
Critters, Clock Works. First Letter Fim. Fun From 
A toZ, .lenny's Journey, Dataquest Fifty States, 
Number Munchers. Paint with Words, Path 
Tactics, Phonics prime Time, Quickflash! . Skyiah, 
Sound Tracks, Speedway Math, Amazing Reading 
Machines, Marketplace, Word Munchers . Words 
at Work. 



Ace-Apple Bimodal Switch: 

Two machines in one 



.25 



Ron Balewski's hardware project will give your 
Franklin Ace lOOO complete Applc-cumpatibihty 
(or make your Apple completely Ace -compatible) 
with the flick of a switch 

PFS ProDOS software 28 

X. [.. Head's key to unlocking Software Publishing 
Corporation's pfs ProDOS scries: pfs: Write, 
pfiiFile. pfsiGraph. pfsiReport. pfs:Plan. 

Using Sider hard drives, 
3V2" 80OK drives, 
& 5V4" drives 

in a DOS 3,3 Environment 



34 



A. L. Head puts them all under DOS 3.3. 



December 



COMPUTIST #50 



New COMPUTIST readers are advised to 
read this page carefully to avoid frustration 
when attempting to follow a softkey or when 
entering the programs printed in this issue. 

What is a softkey, anyway? 

Softkey is a term which we coined to describe 
a procedure that removes, or at least 
circumvents, any copy-protection od a 
particular disk. Once a softkey procedure has 
been performed, the resulting backup copy can 
usually be copied by the normal copy programs 
(for example; COPYA, on their DOS 3.3 
System Master disk)^ 

Commands and control keys 

In any article appearing in COMPUTIST, 
commands which a reader is required to 
perform are set apart by being in boldface and 
on a separate line: 
PR#6 



The I RETUBWI key must be pressed at the end 
of every such command unless otherwise 
specified. 
Control characters are specially boxed: 

e rBFl 

Press [6] . Next j^ace one finger on the key 
and then press [T] . Remember to enter this 
command line by pressing [RETURHl , 

Other spe cial combination keypresses include 
I BRESET I or I CJSRESET [ In the former , 
press and hold down & then press I RESET i . 
In the latter, press and hold down both S and 
r3 then press [RESET I . 

Special requirements 

Special prerequisites for COMPUTIST 
articles, programs and softkeys are usually 
listed at the start under "■ Requirements:". 

Software recommendations 

\Ff Applesoft program editor such as Global 
Program Line Editor (GPLE). 

IE" Sector-editor such as DiskEdit (in the 
COMPUTIST Starter Kit) or ZAP from Bag 
of Tricks, 

\Ff Disk-search utility such as The Inspector, 
the CIA or the Core Disk Searcher 
(COMPUTIST Starter Kit). 

(F* Assembler such as the S-C Assembler from 
S-C software or Merlin/Big Mac. 

ffl' Bit-copy program such as Copy It Plus, 
Locksmith or Essential Data Duplicator (EDD) . 



B* Text-editor {that produces normal 
sequential text files) such as Applewriter II, 
Magic Window II or Screenwriter IL 

B* COPYA , FID and MUFFIN from the EKXS 
3.3 System Master disk are also useful. 

Super lOB and Controllers 

This powerful dcprotection utility 
(COMPUTIST Starter Kit) and its various 
Controllers are used in tnany softkeys. (It is also 
on each Super lOB Collection disk.) 

Reset into the Monitor 

Softkeys occasionally require the user to stop 
the execution of a copy -protected program and 
directly enter the Apple's system monitor. 
Check the following list to see what hardware 
you will need to obtain this ability. 

Apple II + , //e, compatibles: 1) Place an 
Integer BASIC ROM card in one of the Apple 
slots, 2) Use a non-maskable interrupt (NMI) 
card such as Replay or Wildcard. 

Apple II + , compatibles: 1) Install an Fg 

ROM with a modified reset- vector on the 
computer's motherboard as detailed in the 
Modified ROM's article (COMPUTIST #6 or 
Book Of Softkeys III ) or the Dual ROM's 
article (COMPUTIST #19). 

Apple lie, lie: Install a mtxlified CD ROM 
on the computer's motherboard. Cutting Edge 
Ent, (Box 43234 Ren Cen Station-HC; Detroit, 
MI 48243) sells a hardware device diat will give 
you this important ability but it will void an 
Apple //c warranty. 

Recommended literature: 

^ Apple It Reference Manual 

[EC DOS 3.3 manual 

\EC Beneath Apple DOS, by Don Worth and 

Pieter Lechner, from Quality Software 

{FC Assembly Language For The Applesoft 

Programmer, by Roy Meyers and C.W. Finlcy, 

from Addison Wesley 

Keying m Applesoft programs: 

BASIC programs are printed in a format diat 
is designed to minimize errors for readers who 
key in these programs. If you type: 
10H0ME:REMCLEAR SCREEN 

The LIST will look like: 
10 HOME : REM CLEAR SCREEN 
...because Applesoft inserts spaces into a 
program listing before and after ever)' command 



word or mathematical operator. These spaces 
usually don't pose a problem except in line 
numbers which contain REM or DATA 
cotnmands. There arc two types of spaces: those 
that have to be keyed and those that don't. 
Spaces that must be typed appear in 
COMPUTIST as delta characters [") . All other 
spaces are there for easier reading, NOTE: If 
you want your checksums (See Computing 
checksums) to match up, you must key 
ONLY the ' spaces; Sfter DATA statements. 

Keying In Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as 
source code, Hexdumps are the shortest and 
easiest format to type in. You must first enter 
the monitor: 
CALL -ISl 

Key in the hexdump exactly as it appears In 
the magazine, ignoring the four-digit checksum 
($ and four digits) at the end of each line. A 
beep means you have typed something that the 
monitor didn't understand and mtjst, therefore, 
retype that line. 

When finished, return to BASIC with: 
3D0G 

BSAVEtheprogram with the filename, address 
and length parameters •'given in the article. 

Keying in source code 

The source code is printed to help explain a 
program's operation. To key it in, you will need 
the S-C Assembler or you will have to translate 
pieces of the source code into something your 
assembler will understand (see tabic of S-C 
Asseitibler directives in COMPUTIST #17. 



Computmg checksums 

Checksums are 4 -digit hexadecimal numbers 
which tell if you keyed a program exactly as 
it appears in COMPUTIST. 

There are two types of checksums: one 
created by the CHECKBIN program (for 
machine language programs) and the other 
created by the CHECKSOFT program (for 
BASIC programs). Both appeared in 
COMPUTIST #1 and Tiie Best of Hardcore 
Computing. An update to CHECKSOFT 
appeared in COMPUTIST #18. 

If the published checksums accompanying 
program listings and hexdumps do not match 
those created by your computer, then you typed 
the program incorrectly. The line where die first 
checksum differs has an error. 
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CHECKSOFT instructions: 

LOAD Ulename 
BRUN CHECKSOFT 

Get the checksums with: C&j iRETURHl and 
correct the program line where the checksums 
differ, 

CHECKBIN instructions: 

CALL -151 
BLOAD SJeaame 

Install CHECKBIN at an out of the way place 
BRUN CHECKBIN, A$6000 

Get the checksums by typitig the Starting 
address, a period and the Ending address of the 
file followed by a [BYH iRETURHj . 



Correct the lines at which the checksums 
differ. 



v\7hen 



writing 



m&. It RDeXed 



• Remember that your letters or parts of them 
may be used in the new Readers Data 
Exchange even if you don't address it to the 
RDEX editor. Correspondence that gets 
published may be edited for clarity, grammer 
and space requirements . 

• Because of the great number of letters we 

receive and the ephemeral and unpredictable 
appearance of our all-volunteer staff, any 
response to your queries will appear only in 
the RDEX, so it would be more appropriate 
for you to present technical questions to the 
readers and ask for their responses which will 
then be placed in the RDEX section. 

• Address your letters to: 

COMPUTIST 

RDEX Editor 

PO Box I10846-K 

Tacoma, VVA 98411 

• Although COMPUTIST can no longer 

purcha.'^ short softkeys and articles, please 
continue to contribute them but place them in 
a letter to the editor so that they get published 
in the RDEX as soon as possible. 

-RDEXed 



Michael A. Horton 



"f A.P.Tfor.. 



Black Magic 

Datasoft 



Infinite Arrows & Spells 

I would like to say thanks to John Wiegley 
for the info on backing up Black Magic. In 
return, here is an APT for it. 

Set your sector-editor as said in the article 
in COMPUTIST #48, so that it can read track 
$1 , sector $0. Then make the following sector- 
edits. The first is for infinite arrows and the 
second is for infinite spells. 



Trk Set Bytes From 

S05 %m SF9' C6 E9 

$05 J06 S3D- C6E7 



To _ 

EAEA 
EflEA 



Playing Tip, . . You must collect at least 1 
arrow or 1 spell to use arrows or spells 
respectively. 

If your copy does not have the same values 
at the same location then scan for the 'From' 
values and change them to the 'To' values. 

A.P.Tfar... 



Marble Madness 

Electronic Arts 



Unlimited Time 

Here is a iielping hand for the Marble 
Madness fan. In order to have unlimited time 
do the following sector-edit: 



Trk Set Bytes From 



%M %df m 



To 



00 



If you don't find the 'from' value at that 
location scan the disk for GD 77 60 F0 08 A9 02. 
Change the 08 to 00. 

You're NOT liistory 

You may also run into the "You're history! " 
problem. The following sector-edits will fix that 
but it will also create a problem... 

Warning; If you 'die' it will restart y out- 
marble where you died. 



Trk Sot Bytes Fron 

$0A je3 173- 90 77 
$32 20 



To- 



EA EA EA 

60 



If you don't find the 'from' value at that 
location, scan the disk for A9 00 9D 77 60 A9 07. 
Change 9D 77 50 to EA EA EA. The sequence of 
20 66 FD should follow this. Change 20 to 60. 



Entrance to the secret Maze 

The entrance to the secret maze is on the first 
level. On the following picture there is a black 
trapezoid on the left part of the picture. This 
is where you must be when there are 13 seconds 
left on your timer if you wish to get to the secret 
maze. If you don't want to... 




A.P.Tfar.. 



Super Boulderdash 

Electronic Arts 



The following program is for all you Super 
Boulderdash players. It modifies sectors on 
your back-up disk using a 'data table', so that 
the mod fits the side of the disk that you choose. 
In order to use this, make a backup copy of the 
original (COMPUTIST #38) then type in the 
program and save it on a DOS 3,3 disk. 

BSAVE SUPER BOULDERDASH AFT, AjSOO, 
LS168 

To use the APT: 



Run the program: 



BRUN SUPER BOULDERDASH APT 
I ^ I Insert the game backup disk. 
Select the proper side. 



In order to use the APT while playing, do 
whichever of the following that you wish in 
order to use it. 
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COMPUTIST #50 



hold down then press Whai it does 



Softkey for... 



Button B 
BLtton 1 



Esc 
Esc 



Adds 1 to # of men 
Advance to next cave 



Once iti a great while the advance to the next 
cave does not work. If it doesn't work the first 
time, try it Hgain and it should work properly. 
Also, the AfT WRITER won't tell you if there 
are any errors while trying to accss your backup 
copy. 



APT WRITER 


0800 


: 20 


2F FB 20 


58 FC A0 20 


$B244 


0808 


. B9 


IE 09 99 


00 06 


B9 42 


S91D4 


0810 


. 09 


99 00 07 


88 D0 


Fl SO 


S6433 


08i8 


: 10 


C0 AD 00 


C0 10 


Fe C9 


$6AD0 


0820 


: C2 


F0 0A C9 


C6 00 


F0 A9 


$2D57 


0828 


: 00 A2 00 F0 


04 A9 


0C A2 


$7E35 


0S30 


: 0D 85 FF 86 


FE A9 


00 85 


$717C 


0838 


: FD 8D EB B7 


8D E0 


B7 A9 


$0077 


0840 


: 20 


85 01 8D 


El B7 


A4 FE 


$930F 


0848 


. 89 


AA 08 F0 


B3 8D 


EC B7 


S421D 


0850 


C8 


B9 AA 08 


8D ED B7 A9 


$0517 


0858 


01 


8D F4 87 


20 A3 


08 A4 


$7004 


0860 


FE 


C8 C8 B9 


AA 08 


85 00 


$0F75 


0858 


C8 


B9 AA 08 


85 02 A0 00 


$7DB5 


0870 


A5 


FD BO C0 


08 C9 


FF F0 


$4341 


0878 


IC 91 00 E8 


C8 C4 02 90 


$551F 


0880 


FI 


86 FD A5 


FE 18 69 04 


S01F9 


0888 


85 


FE A9 02 


8D F4 


67 20 


SD49E 


0890 


A3 


08 4C 45 


08 86 


FD A6 


SIBES 


0898 


FF 


BD 07 09 


E6 FF 


A6 ED 


$29CB 


08A0 


4C 


79 08 20 


E3 03 


20 09 


$A3EB 


08A8 


03 


60 0E 08 


28 03 


0D 0E 


J26ED 


08B0 


FE 


02 0D 0D 


00 42 


00 0E 


$92B1 


08B8 


07 


E7 03 0D 0D 38 


44 00 


S86C0 


08C0 


4C 


FF 0A A9 


20 8D 


FF 0A 


$37F0 


08C8 


A9 


40 8D FF 


0A A0 


00 A9 


JF44F 


08D0 


00 


99 00 20 


99 00 


40 08 


$99C0 


0SD8 


D0 


F7 EE FF 


0A EE 


EF 0A 


$0E65 


0SE0 


AD 


FF 0A C9 


50 D0 


E8 AD 


J38A9 


08E8 


54 


C0 60 AD 


61 C0 


10 04 


JAF58 


0SF0 


A6 


26 F6 28 AD 62 


00 10 


S0111 


08F8 


03 


4C EE FE AD 61 


00 10 


$7529 


0900 


03 


40 FF FF 


40 FF 


FF 26 


$0643 


0908 


0E 


11 0E 11 


11 20 


IS E7 


$19A9 


0910 


16. 


18 18 60 


48 46 


48 4B 


JB823 


0918 


4B DF 19 A6 


18 D7 


19 09 


$A205 


0920 


CE 


D3 C5 D2 


D4 A0 


03 05 


$6E3B 


0928: 


D0 


C5 D2 A0 02 CF 


D5 CO 


$EA0B 


0930: 


C4 


C5 D2 C4 


01 03 


08 A0 


S15F1 


0938: 


C2 


CI C3 CB AD D5 


00 A0 


50248 


■0940; 


CE CF D7 C3 


C8 C5 


CI D4 


$2D80 


B948: 


A0 06 D2 CF 


CE D4 


A0 03 


$F7B1 


0950: 


C9 


C4 C5 A0 


CF D2 


A0 02 


JFA22 


0958: 


CI 


C3 CB A0 


D3 C9 04 05 


J43B2 


0960: 


BF 


A0 A0 AS A0 A0 00 00 


$3033 



Alternate Realty— The Dungeon 

Datasofl 



Here is a controller to deprotect Ahernate 
Realiry: The Dungeon. This is for Disk 1, Side 
I of the Dungeon Disk. In order to copy the 
other sides use any quick whole-disk copier. 

Controller 

1000 REM OON.AR DUNGEON 

1010 TK = :LT = 35 :ST= 15 :LS = 15 :CD = WR 

: FAST = 1 
1020 GOSUB 490 : GOSUB 610 
1030 GOSUB 490 : GOSUB 510 : IF PEEK (TRK ) = 

LT THEN 1050 
1040 TK = PEEK (TRK ) :ST = PEEK {SCT ) : GOTO 

1020 
1050 GOSUB 300 

1060 HOME : PRINT "COProONE" : END 
1070DATA0 .5 .73 ,0 

Controller Checksums 



1000 - $356B 

1010 - $2544 

1020 - J08CD 

1030 - $0B00 



1040 - $A107 

1050 - S7BCE 

1060 - $08ED 

1070 - $B813 



If this does not work scan the backup disk 
for C9 CO 00 ED BD 8C 00 and change ED to 00. 



More A. P. T.s for.. 



SmrdOfKadash 

Penguin 



Those APT's sent in by Russell Meyers are 
okay, but what would you choose: lots... or 
infinite. UisSn^rJofKadash A.P.T. is just so- 
so, I say this because 'why should you have to 
die stall?'. 

1^ Immortality 

Scan for E9 01 8D 00 44 E0 06 08 68 and change 
the last 2 bytes from 08 68 to 90 04. 

Your hit points go down but you never die. 

«/■ Infinite spells 

Scan for AD 15 44 F0 10 AD FF 6E and change 
F0 IC to EA EA. Scan for 80 FF 17 AD 15 44 F0 3E 
and change E0 3£ to EA EA. 

No more illegal character diiik 

Scan for 20 00 03 AD 16 44 00 03 and change 
the 3 bytes following it to EAEAEA. Scan for 90 
F8 CD 19 44 F0 03 and change the 3 bytes after 
it to EA EAEA, 

Playing Hint: Sometimes secret doors are 
blocked by shootable invisible wails. 



What's What On Your Character Disk 

Here is a list to show you what's what on 
your character disk. All of the data is on track 
$22, sector $®F 

lyte Explanation 




your room iClSOO-SFF) 

integer X-coordinate divided by 7 

Y-coordinate 

X-coord. remainder (X = BSCIl*7 + B$©3) 

weapon ^(SCIO-SOB), SFF if cursed 

armor #(Sfl)C-S12). SFF i! cursed 

weapou # if cursed 

armor # if cursed 

level 

are you cursed? SOO = NO iSGil = YES 

low byte of maidinum hit points XXW 

high Ijyte of maximum hit points .XXYY 

low byte of current hit points XJft V 

high, byte of current bit points XX'YY 

armor class 

??7 

low byte of experience XXVI 

high byte of experience 'SXTt 

number of spells 

usually $FF, must be ncm-zero for 

character to worlt 

(SOffl-SlS EORed together) 

number of lives left 



A.P.T. for.. 



Rescue Raiders 

Sir-tech 



^ Unlimited bullets and napalm. 

Trk Set Bytes Froni To 

S0F 504 J25 DE F6 60 EA EA EA 



p^ Unlunited bombs 

Trk Set Bytes From To 



S0F $04 S9C 



D£ F4 60 



EA EA EA 



i^ Unlimited missiles 

To 



Trk Set Bytes From 
J0F J06 $37 OE 02 |1 



EA EA EA 



F^ Turn Bullets into napalm 

Trk Set Bytes From To 



$0F $04 $20 F0 E3 



EA EA 



Playing Hint: Missiles fire when at the same 
altitude as enemy copter. 



COMPUTIST #50 



Oecembar 



Mike Maginnis 



A.P.T.for.. 



Auto-dael 

Broderbund 



Ressurect a dead Auto-dueler 

Mr. Scott, in his Autn-duel Editor in 
COMPUTIST H2, page 22 (which is excellent 
- I have used it countless times since it was 
printed), failed to mention how to ressurect a 
character if it dies. Do you know how 
frustrating it is if a character that you've been 
working on for months dies and you have to 
start over? 

Well, to ressurect a dead Auto-dueler, simply 
change byte $1B of track $1A, sector $00 to 
80 with a sector-editor and he/she lives again! 



Kracker Jack 



*IIgs Softkeyfor... 



Music Construction Set (MCS) 

Electronic Arts 



Copy the MCS program to a blank 



iVi"' disk. (I use Diversi-Copy). It will copy 
without errors, but it won't run. 

I_? I Format a blank 5'A'" disk with 

ProDos (I use Copy f! Plus 7.4} 

I 3 I Copy the file MUSICCS.SYSTEM 
to the formatted floppy. 

L^ I With a sector-editor (Copy II Plus 

again), look for the sequence 20 lA B5 A9 01 in 
the file. I found it on track $9, sector $1, byte 
S3 1 . Change 20 to 60 and write it back to the 
disk. 

I ^ I Copy the file back to your 3W 

copy of MCS and you are donel 



*IIgs Softkey for, . 



Paintworks Pius 

Activision 



Make a copy of your 3 'A " original 



disk. Ignore any read errors on block 7. I use 
Diversi-Copy. It's the fastest copier that I have 
found for 3'/;" disks. 



I_? I Boot your Apple Ilgs system disk 

and get into BASIC. 

I 3 I Type: 
PREFIX/ PAIHTWORES 

BLOAD PAIHTW0RK$,T$B3, ASIOQO, UlOOO 
POKE 6621,96 
BSAVE PAINTW0RKS,TSB3, ASIOOO, LSIOQO 

*IIgs Softkey for. . . 



Music Studio 

Activision 



Make a copy of your 3 '/i " original 



disk. Ignore any errors on block 7, 

I ^ I With a ProDOS block-editor, find 
byte $14 in block $44D. Change it from F0 to 
80 and write it back to the dislc. If you don't 
have a block-editor, use a sector-editor to find 
the sequence 0C 00 C9 01 00 F0. Change the F0 
to 80. 



*//gs Softkey for. , 



Sliangiiai 

Activision 



Make a copy of your 3 'A " original 



disk. Ignore any read errors 

I ^ I With a ProDOS block-editor, find 
byte $E1 in block $243. Change it from F0 to 
80 and write it back to the disk. 



'"Ilgs Softkey for... 



Reader Rabbit 

The Learning Co. 



It appears that the Learning Co. is reading 
your magazine. A few months ago I .sent in a 
crack for their program Reader Rabbit, and now 
they have changed the copy-protection on it. 



I ^ I RUN COPYA and press fSCl in 
answer to the prompt to interrupt the program. 

I_? I Delete line 70 and tell DOS to 



Ignore errors. 

70 

POKE 47426,24 



[i: 



Now RUN the program again. 



RUN 



I ^ I With a sector-editor, find the 

sequence BC 8C C0. I found it on track S13, 



sector SD, byte S53, Change the BC to 60 and 
write it back to the disk. 

Softkey for. . . 



Matti Rabbit 

Learning Co. 



This method also works on Math Rahhit, 
another Learning Co. program. I found the 
same sequence on track $A, sector $©B, byte 
$44. Change the BC to 60 and write it back to 
the disk. 

t Sofikeysfor... 



Baseball Database 

Jacobsen Software Designs 



Mastery Aritimetic Games 

Mastery Development 



I almost forgot. Here is a crack for two other 
programs. 

The Baseball Database from Jacobsen 
Software Designs and Mastery Arithmetic 
Games from Mastery Development can boUi 
be cracked with the Super lOB softkey for Side 
B of Sword of Kadash from COMPUTIST #27. 

No other mods are necessary, just run Super 
lOB, choose side B when asked, and copy the 
disk. 



Guy Kendall 



Softkey for.. 



James Bond 007 

A View To A KiU 

Mind scape 



This program is a text adventure and a pretty 
lame one so far. I haven't gotten too much into 
the game because the program is sooooo slow, 
1 keep thinking it's locking up because it will 
give me a prompt and then sit there without 
accessing the drive. 

The program is written i.s UCSD Pa.scal. I 
looked at it with Apple Pascal and listed the files 
but I don't know enough about Apple Pascal 
to change anything. 

@ Maybe someone could find a way to put 
a faster Pascal on it. 

First I got out Bag ofTrichi and used TRAX 
to exatnine the prologues and epilogues. 1 found 
that the address and data epilogues had been 
changed from DE AA to FF FF. So 1 knew that I 
needed to tell DOS to ignore this. 



December 



COMPUTIST #50 



I decided to have DOS ignore all epilogue 
and checksum errors by changing $B942 from 
38 to 18 and running COPYA. It copied fine 
but when I booted the copy it just kept re- 
booting. This told mc that there must be a 
nibble-count of some sort. 

I got out my trusty Copy II Plus sector-editor 
and started looking around. I searched for a 
reference to the rc-boot routine (SC6O0) and 
sure enoungh I found a 4C00C6 (JMP $C6O0) 
at track $00, sector S0C, byte $94. 1 replaced 
this with EA EA 60. This is NOP NOP RTS 
where NOP is No Operation and RTS is 
ReTurn from Subroutine. This was all it took 
to get a working copy. Have fun. 



\^J 



Tell DOS to ignore all epilogue and 



checksum errors. 
POKE 47426,24 



Use COPYA to copy the entire 



disk. 

RUN COPTA 



Make the following sectpT-edits. 



Trk Set Bytes From 



To 



$00 J0C $94 4C 00 C6 



EA EA 60 



That's all it takes. 



The Dabbler 



Softkey for., 



Might And Magic 

Activision 



I recently deprotccted Might and Magic, a 
role-playing computer game in the genre of 
Wizardry. Deprotecting it simply consists of 
changing one byte on the program disk. 

■ Requirements 

D Four blank disk sides 
D A Fast copy program 
n Original Might and Magic 



Copy all sides using a fast copy 



program, such as Disk Muncher, Copy II Plus 
copy disk, etc. Ignore any error on track SOD 
(decimal 13). 

I ^ I Search copy of Disk A (Program 

disk) for D0 FB E5 01 . On mine it was kx-'ated on 
track $0, sector $F, byte $87. 

L5 I Replace D0 (branch command) 

with a 60 (return from subroutine). Write this 
sector back to disk. 



[^H 



Put away your originals and breathe 



a sigh of relief. 



Magnus Hedlund 



First, I'd like to congratulate you on a great 
magazine. I've really enjoyed it and Just 
renewed my subscription. 

Here are some hints for The Coveted Mirror 
and Ultima IV, 



Playing Tips for.. 



Tlie Coveted Mirror 



D "LOOK' ' at things in your prison cell to help 

get out. 
n "TALK" to everyone you meet. 
D Map out the twisty passages entirely. 
n Read the Magician's book for more hints. 

(2) And, If anyone knows how to become 
invisible, please tell me. 

Playing Tips for.,. 



Ultima IV 

Broderbund 



n Frequently visit Lord British and ask him 

to "HELP" you. 
D To heal all of your party, a.sk Lord British 

"HEALTH" and then say "NO", 
n Map all of the moon gates (they each last 

3 cycles). 
O To have everyone possible join you, You 

must be 8th level. 
n A secret door has a white dot in the wall right 

in the center. 



Jon Bernhardt 



I have COMPUTIST #1—4, and #9 to your 
most recent and I think they are great. I have 
a lot of original programs backed up thanks to 
your magazine. Although I don't know 
a.ssembly Language very well I was able to back 
up a program on my own. 



Softkey for... 



Award Maker 

Baudville 



and William Forsyth (COMPUTIST #32), I was 
able to look in the right areas and tix my 
original copy of Award Maker by Baudville. 
I found the copy protection on track $0 sector 
$5. By using the sector editor on Copy II Plus 
I changed thetwojumpstatements at byte $76 
and $8 A. 



Trk Set Bytes From 



To 



$00 $05 $76- 


20 91 09 


EA EA EA 


$8A- 


20 91 09 


EA EA EA 


$5C 


? 


60 



I added a return at $5C because there was 
a return at $5B and this avoided the copy- 
protection that followed S5C, I could not find 
the jump to $5C. The jump at $5C gets you past 
the "NOT AN ORIGINAL DISK" message 
and the removal of the two jumps allows you 
to get past the junk border that they use. 

Keep up the good work and I would like to 
see more articles that explain things. 



Brian Symonds 



Softkey for.. 



Principalis Assistant 

Learning Well 



This poster-, certificate-, and award-making 
program gives darker printouts than the 
Certificate Maker (at least on my printer). It 
is easy enough for a child to use, and of course 
is copy protected, and comes without a backup. 
It is difficult to copy with a copy program. 

The protection scheme involves using 
changed address-field epilog bytes on all tracks, 
and changing the first byte of the address-field 
prolog from D5 to W on odd-numbered tracks. 
Make your COPYA backup as follows: 



I ^ I RUN COPYA 

i ^ I After the disk drive stops, halt the 
program. 

Cec] 

I 3 I Remove line 70 so COPYA won't 
reload COPY. OBJ 
70 



Thanks to J.J. Gifford (COMPUTIST #37) 



I ^ I Enter the monitor: 

CALL-151 

l_5 I Make the following DOS changes, 

I ^^ I Patch DOS to ignore the first byte 
of the address header: 
B9H:29 00 



10 



COMPUTIST #S0 



Decembsr 



I ^^ I Patch DOS to ignore the address - 

field epilog bytes 
B933:13 60 



[A 



Re-enter BASIC and start up the 



altered COPYA : 
RUN 



\^3 



Be sure to copy both the Master 
side of the disic and the Art side of the disk. 

I always make a touple of copies of the 
protected disk with different boots of my disk 
with COPYA on it, then use the 16-sector utility 
compare program on Locksmith to compare the 
copied disks. I reeopy any sectors that do not 
exactly compare. Occasionally it seems that the 
DOS patches lead to erroneous reads of the 
protected disk. 



John Einstein 



I was bored one afternoon so I decided to 
attempt deprotecting Conflict in Viemam by 
Micro Prose. 



Softkey for, , 



Conflict Ib Vietnam 

Micro Pro.se 



'■ Requirements: 

n Fast copier 

C Sector- editor (with file follower) 

□ One blank disk 

Deprotecting Conflict did not take long (only 
an hour and a halt) because I made sure I did 
a little research into Microproses' protection 
schemes first. 

Because the boot looked similar to that of 
Silent Service, I used that softkey as a guide. 

The first thing I did with the disk (as I do 
with all of my protected programs) is try to back 
it up and get it into DOS 3.3 format. As it 
already is in DOS 3.3 format all that was 
necessary was to use a simple data mover (i.e. 
COPYA) to copy the disk (both sides). 

Next, I simply booted the disk to see where 
it crashed. It crashed just after loading DOS and 
the boot up program (which was called //, more 
on that later). 

Because the disk was in DOS 3,3 format with 
a standard file structure (catalog track at $1 1), 
I simply found the bootup program (whose file 
name is located in the first three tracks of the 
disk, where you will find DOS) and using the 



file follower with my disk editor (SNOOPY ) 
tracked down the file and the located valid 
program data. 

One small problem I could have had if [ did 
not use the file follower became apparent when 
I cataloged the disk. There were two files called 
// one of them was located at track $FF (as my 
sector editor told me), I attacked the other one. 

BLOADing didn't work. The phony fdegetsin 
the way . I found that the program I needed to 
work with was located at track S0F, sector $02 
(the file follower goes to the first sector of the 
file which was sector S03, go backwards like 
DOS docs through the disk and you should get 
program data. 

Now, 1 knew I had found the program 
because I saw at the end of" the program 
Mieroproscs welcome message "HARDWARE 
FAILURE!". Bingo! 

After that I checked for the usual condition 
branches that sends the program into never 
never land and displays the welcome message 
"HARDWARE FAILURE!". 

I found that the author of this protection 
scheme used three BCSs' (Branch if Carry Set) 
at bytes $67, $6F, and $97 to keep the owner 
of the disk honest (and in the dark). If, after 
checking the disk three times, the protection 
scheme finds no problem with what it sees on 
the disk, the program will follow through and 
execute the game, 

I simply NOPed each of the AGS 
instructions. 



Copy the disk (using COPYA, 
Locksmith'^ FASTCOPY, etc.). Both sides! 



the BCSs. 



Get out your sector-editor and NOP 



Trk -Set Byt es 

J0F 102 557- 
J5F- 



From 



To 



EAEA 
EAEA 
EAEA 



That's all. 



Bill Beach 



Softkey for. . 



Tlie American Cliailenge 

Mindseapc 



After receiving COMPUTIST #40 a couple 
of days ago, and seeing another softkey listed 
in the input section for the American Challenge 
1 decided to try again. The one in COMPUTIST 
#33 did not quite do the job, Lo and behold, 
COMPUTIST #4© did not help much either. 
Both programs did allow the beginning to load 



in but did not take care of the next protection 
routine which is used just before starting to 
play. 

The softkey in COMPUTIST #40 did give 
some important information which is used in 
this softkey along with the removal of a JSR 
to $02F6 which seems to do a nibble count 
somewhere on the disk. 

The controller listed here worked for me. 

Controller 



15 :CD = WR 



GOSUB 



END 



1000 REM THE AMERICAN CHALLENGE 
1010TK = ;LT = 35 ;ST = 15 iLS^ 

: FAST = 1 
1020 RESTORE : GOSUB 170 : GOSUB 490 

610 
1030 Tl = TK : TK = PEEK (TRK ) - 1 : RESTORE ; 

GOSUB 310 :TK = T1 
1040 GOSUB 230 : GOSUB 490 : GOSUB 610 : IF 

PEEK (TRK) =LTTH£N 1060 
1050 TK = PEEK (TRK ) :ST = PEEK (SCT ) ; GOTO 

1020 
1050 HOME : PRINT "COPrDONE" 
5000 DATA 255 ,255 ,255 ,255 
5010 DATA 2rCHANGES 
5020DATA0 .11 ,35 .234 ,0 
,41 .234 ,0 
,47 ,234 ,0 
,57 .234 ,0 
,71 .234 .0 
,84 ,234 ,0 
,93 ,234 ,0 
,108 .234 ,0 
,123 ,234 ,0 
,116 .234 ,1 
.234 



5030 DATA 
5040 DATA 
5050 DATA 
5060 DATA 
5070 DATA 
5080 DATA 
5090 DATA 
5100 DATA 
5110 DATA 7 
,14 



.11 
,11 
.11 
.11 
,11 
,11 
,11 
,11 
,14 





37 ,234 




42 ,234 




48 .234 




58 ,234 




72 .234 




85 ,234 




94 ,234 


,11 ,109 .234 


,11 ,124,234 


,14 


,117 .234 



IS 



Controller Checksums 



1000 
1010 
1020 
1030 
1040 
1050 
1050 
5000 
5010 
5020 



$356G 

$2544 
$73B0 
$7B6E 
I42F4 
$A513 
J148C 
$8C24 
t571B 
I75BD 



5030 
5040 
5050 
5060 
5070 
5030 
5090 
5100 
5110 



$7C56 
$73AD 
$4766 
$DEC9 
$B62F 
$5790 
$C70A 
$4FBA 
JEA4B 
$0000 



It is possible that the call to the nibble-count 
routine may be located somewhere else on the 
other disk. To be sure you can always change 
line 5010 to DATA 18 CHANGES, delete line 
51 lO, and use a disk-search utility to look for 
4C F6 02 and change it to EA EA EA. 

1 hope that this will be the answer for those 
of you that had difficulty getting this program 
to work. 

Thanks for a great magazine, I read it from 
cover to cover and then use every bit that I can, 
then 1 list it all in the data base. 

I recently ran across a protection method 
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which changes the nonnal locations of volume, 
track, sector information on the address header 
to be track, sector, volume, 

(^ Is there any way of modifj'ing Super 
lOB so it can handle this type of protection'? 
So far I have not been able to get to the 
RWTS through booi-tracing because the first 
sector docs some EORing that I can't get past 
yet. 



tSoftkeyfor... 



i 



Anyone have any suggestions on how to 
overcome this problem? RDEXed 



Jack R. Nissel 



Softkey for.. 



Arcade Album // 

Penguin 



To deprotect Arcade Album #/, by Penguin 
do the following. 

I ** I Install the controller shown below 

into Super lOB. 

Make the following sector-edit to 



your copy. 

Trk Set Bytes From 
$00 103 (42 



To 



38 



18 



Controller 



1000 REM ARCADE ALBUM n 

1010 TK = :LT = 4 :ST = 15 :LS= 15 :CD = WR 

: FAST = 1 
1020 GOSUB 490 :TI = TK :LT = TK4 1 : RESTORE 

: GOSUB170 : GOSUG 2000 

1025 GOSUB 610 : IF PEEK (BUF ) <MDANDLT<> 

35THENLT = LT + 1 :TK = TK+ 1 : GOSUB 

2000 ; GOTO 1025- 
1030 GOSUB 230 :TK = TI :LT = 35 : GOSUB 490 : 

GOSUB 510 : IF PEEK (TRK ) = LT THEN 1050 
1040 TK = PEEK (TRK ) ;ST = PEEK (SCT ) : GOTO 

1020 
1050 HOME : PRINT "COPVTONE" : END 
2000 POKE 47445 ,212 4 (TK / 2 = INT (TK / 2 ) ) 

: RETURN 

5000 DATA 218 ,170 ,218 ,170 

Controller Checksums 



1000 - S356B 

1010 - SE254 

1020 - S6207 

1025 - S73EA 

1030 - S2E8D 



1040 - 5E09C 

1050 - J33B7 

2000 - $468A 

5000 - JFA96 



Expedition Amazon 



Penguin 



■ Requirements: 

Q Controller for Sword of Kadash in 
COMPUTIST #27 



I * I Use the Sword of Kaikish controller 
from COMPUTIST #27. When prompted to 
enter (B)ack, use the controller for the back side 
of Sword of Kadash. Use this for both sides of 
Expedition Amazon. 



sMte h 



Make the following sector edits to 



rk Set Bytes 


From 
38 




To 


00 $03 $42 


^. 


$35 


DA 




te-' 


■.$91 


DA 




D£ 


.■$5.4- 


4A 49 


6A 


09 D5 D0 


m- 


D0 EF 




F0 EA 



.and the A.P.T for.. 



Expedition Amazon 

Penguin 



Alter The Prices for Equipment 

The trading post equipment prices are shown 
in text on track SOB, sector $02, bytes $83 to 
FF and on track $1A. sector $05, bytes 
$O0— 13. 

The values are stored as ASCII with the hi- 
bit clear. IE. $30 is O, $31 is 1, ..., $39 is 
9. To change the cost of the equipment simply 
change the value shqwn to the one you're 
willing to pay. 

The price of the LOREN is shown in text as 
99000 and in hex as 39 39 30 30 30. To change 
this to 1 in the text, change the hex to 31 20 20 
20 20, 



Jerome Thelia 



Softkey for. , 



Migiit and Magic 

New World Computing/Activision 



■ Requirements 

n Sector-editor 

[~1 copy program that will ignore errors and skip 
tracks. 



Might and Magic is a multi-player fantasy 
role-playing simulation in the dungeon delving 
tradition of Bard 's Tale and Wizardry. After 
forming a party of six able men and women, 
it is your task to take them on a lengthy 
exploration of a variety of terrain and perils. 
Your search will be for the Inner Sanctum and 
the key to its secret. 

Since only the boot side is protected, sides 
B, C, and D can be duplicated using COPYA 
or similar. 

The protection is similar to that of some 
Accolade software. Except for track $0D, the 
disk is of standard fortnat. 

Soon after the title screen is displayed, the 
program code performs a JSR to the protection 
check. If unsuccessful, it reboots. This JSR can 
be cancelled buy a NOP statement, liberating 
the disk from the evil shackles of 
copy -protection. 

The irregular format of track $0D will 
produce an error and interrupt the copy 
procedure if using COPYA, so you must use 
a copy program that can skip the track or ignore 
the error. 

When the copy is made, you can implement 
the required changes in code with a 
sector-editor. 



track SOD. 



Copy Side A ignoring the error on 



Make the following sector-edits to 



bypass the protection check. 

Trk Set By tes From 

%m $0A SAB- 20 00 8E 



To 

EA EA EA 



That's it. 



Matt Evans 



Spindizzy is a fun game to play, but it can 
berepetitous if you aren't very good. Of course, 
game disks can get thrashed about and so I 
decided to try and softkey this one. 



Softkey for. . 



Spindizzy 

Activision 



■ Requirements: 

D FID or some other file copy program 
D A blank disk 

First, let me say that this is a classic example 
of putting too much strength into a problem 
without first trying the easiest method. 
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The first thing I did was to trj a nibble- 
copier. The copier didn't copy the program very 
well. I tried another nibble-copier with no luck 
either. What happened with the copy 1 did 
make, was that after a few seconds of boot, the 
drive would make its infamous noise stating that 
it didn't like what was on the current track, 
Hmmm,.. 

After viewing the errors the nibble-copiers 
recorded, I thought the program was doing 
.some sort of nibble-counting. I then booted the 
disk again and interrupted the boot with my 
Wildcard to see if 1 could find any interesting 
code that might lead me somewhere. I couldn't 
find much. 

Well , after a few more similar efforts, I tried 
a track-dump program found in the Beneath 
Apple DOS book. Investigating the track -dump 
code from track O, all the correct sector headers 
were there. You know the familiar 05M95 etc, 
1 wondered if the disk was not protected at all, 
and catalogable. 

I booted up my DOS 3,3 system master to 
get DOS 3.3 into the machine. Then, I put the 
Spindizzy disk into the drive and typed 
CATALOG. Guess what? The disk is 
CATALOG-able! So far so good, but I still need 
to he able to load the programs from BASIC. 
It turned out that all the programs can be loaded, 
re-saved, locked, renamed and everything; 
merely the program wouldn't boot. Hmmm... 

From experience, this tells me that one of the 
programs on the disk exist merely as a 'disk- 
checker* program or nibble-counter program 
that verifies the original disk. Generally this is 
done either by a nibble-count routine or a trick 
checksum routine. All I had to do was disable 
thai routine or get rid of the entire program and 
that should do the trick. 

L0ADER1 

On the Spindizzy disk is a file called 
LOADER. This sounds too easy. I BLOADed 
LOADER and checked the BLOAD address by 
entering the monitor and checking locations 
$AA72 and SAA73, The program staned at the 
usual address of $800. If the program does a 
hibblc-eount or checksum, usually the code is 
easy to find, then it is time to dissect the code. 
The part that makes it easy to find the special 
disk code, is to look for a LDA $C08C,X, That 
is the indication that the program is reading 
something from the disk on Its own and not 
through DOS. 

I begin to examine the code at $800 to find 
.something special. The first few lines merely 
set up the reset key so that you can't bomb the 
program. Then, the address of the data table 
that LOADER uses is put into locations SIO 
and $11 ($08FA), Then, the series of LDA's 
in the nc\t few lines load data from the data 
tabic and perform a JSR $FDED which means 
they are printing something. 

What? I went to the data table at $8FA to find 



out. Located here are the names of ALL the 
other files on the disk, 

LOADER loads in all the files into memory, 
then, once a O is found in the data table (tested 
at $840), the program continues at $85 A. 

This, so far, is pretty much straight forward. 
You can see that the code is just looping and 
there Is nothing special (LDA $C08C,X) in the 
code, 

BUT,,, when the code continues, all the 
programs have been loaded in and a JSR $C00 
occurs. This is the next stage in the boot. 

Now, 1 BLOAD SHELL at ASC0O,Itbund out 
that it loads here by examining the data table 
which specifies all the addresses of all the 
programs, 

1 begin looking through the code at SCO0, 
Again, immediately the reset is played with 
again so the program continues execution 
instead of rebooting. The program can do this 
because It manipulates reset by copying the 
monitor ROM Into the RAM card and then 
modifying those parts of the ROM code that 
weren't meant to be changed. 

Anyway, a tricky little hit of code comes next 
that, after deciphering, sets up an lOB for DOS 
3,3, for a track $4 'seek' (not read or write, 
just seek). Then, as expected, a JSR SC41 
occurs which results in a JSR $B7B5 which is 
a call to DOS's RWTS routine that controls disk 
access. 

So, the special routine is beginning to unfold, 
though we haven't found the core. 

The program moves the drive head to track 
$4 but nothing happens, ..yet. 

After the JSR $C41 call, a little playing takes 
place to clean up the lOB, Then, the kleker... 
A JSR SC51 is seen, 

I began looking at the code starting at SC5 1 , 
The first instruction is LDA SC089,X, which 
isn't EXACTLY what we are looking for, but 
it is extremely close. 

Anyway, that command turns on the disk 
drive so it starts to spin, whether or not it was 
spinning in the first place. 

Then, the special code begins. Lots of 
playing around and a few LDA $C08C,X (or 
in their ease LDY $C08C,X; this performs the 
same feat though, read a byte off the disk). My 
main concern Is the comparisons done after the 
LDY $C08C,X. The things that get compared 
are not familiar bytes that should be on a disk. 
Also, after the five LDY $C08C,X's, there is 
a big giveaway. At SC96 here is the code: 



0C96- 
0C98- 



49 AA 
8D BD eC 



EOR ejAA 
STA J0CBD 



Checksum or Nibble-Count 

This Is the giveaway that the code Is a 
checksum and not a nibble-count. What I 
assume now, is that somewhere else In the 
program, $0CBD Is checked to make sure it 
is equal to a certain number. If it is. the program 



continues; If it Isn't, the program aborts or does 
whatever it wants to. 

There are two ways to find out what that 
number should be. 

You can continue to boot-trace the code until 
you find the comparison, and It can be just a 
few more lines to a long ways away, or you 
can stop the program here and find out what 
is In $OCBD, 

This is where I think the copy -protectors 
fouled up. I chose option 2, 

Since the program ties up the reset and I have 
a Wildcard, the easiest way for me to bomb into 
the program is to use my Wildcard. So, during 
the boot, after I saw the drive head move to 
track $4 (I had the drive cover ofl), 1 pressed 
the Wildcard button and jumped Into the 
monitor. There was a S55 in location $0CBD, 
So, what I tried next was the solution. The 
critical routine starts at $0C5 1 , so I decided 
to load the accumulator (A register) with $55 
and continue at the STA SOCBD at $C98 so 
the program would store it itself and confinue 
with the rest of the program as if nothing 
happened. 

So, I booted DOS, changed the program, 
saved it back to disk and everything worked! 

Step-by-step 

I ^ I Boot DOS 3.3, 

i_? I Put in a blank disk and write a quick 

hello program. 

NEW 

10 PRINT CHR${4);"BRUN LOADER" 

INIT HELLO 

I ^ 1 Use FID or some other file copy 
program to copy all of the files from the 
Spindizzy disk to the new initialized disk. 



Put in the new disk and load In the 
program called SHELL. 
BLOAD SHELL, ASCOO 



Enter the monitor and change some 



code, 
CALL -ISl 
C51:A9 55 4C 98 OC 



[Z 



Save the changed file back to disk, 
BSAVE SHELL, A$COO, L$2F(B 

Have fun with Spindizty\ 

One thing to note. Since the disk access 
routine is skipped, the drive will stop earlier 
than normal, meaning you won't be able to start 
the game Immediately after the drive stops like 
before. You will have to wait about one or two 
seconds. This does not mean that this softkey 
makes the program longer to boot, it means that 
Spindizzy left the drive running for no reason 
until the program was ready to run. 
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Darryl Higa 



Softkey for... 



Computer Prep, for SA T v3.1E 

HBJ Inc 



A previous sofikey in COMPUTIST ti'i9 did 
not work for mine. It was really way off but 
maybe that was for another version. This 
softkey is for version 3. IE, 

I * I Copy sides A, B, and C with 
Locksmith 5.0 FASTCOPY (or a similar 
copier) and ignore the errors on tracks $©, $2 1 
and $22 or copy tracks $3 — $20. 

I ^ I Use a sector-editor (I used Copy II 
Plus) and move track $12, sector $0 to track 
$1 1, sector SO on the duplicate disk. 



to the disk, 

I For Side D, 



\3 



Copy DOS (preferably a fast DOS) 



first initialize a disk. 



Now you must capture their 



RWTS, Put side D in the drive and: 

CALL -151 

9G<IQ<C6IM».C6FrM 

96FS:A9 00 8D 4A 08 4C 01 08 

960QG 

6000<B800.BFFFM 

[ 



6 



Remove side D and insert the disk 



initialized in step 4 and boot it, 

G 



] 



Save the RWTS: 



BSAVE RWTS.SAT, A$6000, LSSOO 

I ° I Use this swap controller to copy 
tracks $3 - $22. 

Swap Controller 

1000 REM COMPUTER PREP FOR THE SAT V3 . IE 
1010 TK= 3 :LT=35 :ST = 15 :LS = 15 :CD = WR 

: FAST = 1 
1020 GOSUB 360 : GOSUB 490 : GOSUB 610 
1030 GOSUB 360 : GOSUB 490 : GOSUB 510 : IF 

PEEK (TRK) =LTTHEN 1050 
1040 TK = PEEK (TRK ) : ST = PEEK {SOT ) : GOTO 

1020 
1050 HOME : PRINT "COPY'DONE" : END 
10010 PRINT CHRS(4) ; "BLOAD'Ryn"S.SAT.A$1900" 

Controller Checksums 



1000 - $356B 

1010 - 12445 

1020 - $C908 

1030 - $FB9C 



1040 - $0D4F 
1050 - $C7BE 
10010 - $4EBC 



Maybe there is an easier way to do this, but 
I recently started cracking disks and this method 
works well for me. In a couple of months, Fll 
probably laugh at this softkey. 

Playing Tips for... 



World Karate Championship 

Epyx 



To get the maximum amount of points 
(2000 points) tor breaking the bricks, move 
the joystick up and down when there is a bubble 
by the judge's mouth. Keep on moving the 
joystick up and down quickly while he says 
''Get ready.,, Go", By pressing I SHIFT j and 
the I + I key, the background scenei^' adva nces. 

To see something s-t-r-a-n-g-e, press I B 1 
when you are just a white belt. 

Softkey for... 



HardbaiJ 

Accolade 



The softkey for Hardball by Accolade in 
COMPUTIST #33 did not work on my version. 
While I was snooping around, 1 found a JuMP 
to SC6O0. 1 tried NOPing it and it worked! 



Boot DOS 3.3 and enter monitor. 



\^2 

I ^ I Tell DOS to ignore errors: 
B942:18 



1 3 I Run COPYA and copy the diisfe 
I ^ I Make these sector- edits. 



Trk Set Bytes From 
S00 $00 $71- 40 00 C6. 



To 



EA EA EA 



IICJ 



Write sector back to disk. 



Softkey for... 



World Karate Championship 

Epyx 



Just recently, I got World Karaw 
Championship by Epyx from a friend. ( looked 
at back issues of COMPUTIST hoping to llnd 
some kind of softkey that would work. 

In other softkeys, NOPing out the JuMP to 
.$C600 would do the trick so I tried it. ft didn't 
work. 

Then I came across Contach's softkey for 
Koroni.s Rift, also by Epyx, in COMPUTIST 
#34 and noticed how similar the protection 
scheme was to World Karate Championship. 

I boot -traced my disk and found the nibble- 
count at location $900. I jotted down the first 
couple of lines and searched through my disk. 



I found it on track $00, sector $0E. 

By changing all the branches to $97F instead 
of $99B, the disk was copyable. 



I ^ I Boot DOS 3,3 and enter monitor, 

l_2 I Tell DOS to ignore errors: 

B942:18 

1 3 I Run COPYA and copy the disk. 

I ^ 1 Make these sector-edits: 



Trk Set Bytes 


From 


To 




S00 $0E $24 


76 


5A 




$29 


71 


55 




$39 


61 


45 




$47 


53 


37 




$54 


46 


2A 




$6D 


3D 


21 




$6C 


2E 


12 




S7B 


IF 


03 





LE 



Write sector back to disk: 



Help wanted for.. 



Championship Wrestling 



(J) I also got Championship Wrestling from 
Epyx but 1 can't seem to bypass its protection. 
It basically has the same kind of protection 
scheme (nibble count) as the others but it docs 
not have any JuMP to $C600, 1 think the nibble 
count routine is at location $BBOO or track $0, 
Sector $5 on the disk but 1 still can't crack it. 
Can anyone help me? 

More A.P.Ts for... 



Rescue Raiders 

Sir- Tech 



In my version of Rescue Raiders by Sir-Tech, 
1 have to type in BOBBVPIN to get into the 
cheat mode. 

The APTs by Russell Meyer and others did 
not work on my version. 

Bytes S6F, S74, and S83 on track $D, sector 
$0 has the amount of missiles, bombs, and 
rockets respectively. 

To get unlimited bombs, you must NOP 
bytes $48 and $49 (m track S0F, sector $04. 
NOPing bytes $DB— DC on track SOF, sector 
$03 changed my bullets to napalm. 

Also, on track $0D, sector $0O, byte $6A 
contains the amount of fuel you have. By 
changing this to FF, you don't have to worry 
about refueling for a long time. But beware, 
if you land your chopper on the pad to refuel, 
you're goijig to get a big bang. 

I've noticed that whenever you do this, the 
game will do funny things: freeze up or reboot. 
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In COMPUTIST #16 Clay Harrell had a 
softkey and he had sector-edits to defeat the 
level problem. I tried typing it in and so far, 
1 haven't had any weird things happening. 



Trk Set Bytes From 

$0E JBB $65_ fl2 03BDA2 
$69_ 60 ID A3 60 



To 



18 A9 00 8D 
AC 60 F0 43 



<2) By the way, from level 5 on, you get 
napalm BOMBS. Does anyone icnow how to get 
them from level 1 on? 



Playing Tips for.. 



Rmdam 

Magnum Software 



In this game, you will be asked Lo give an 
incantation spell which will enable you to pass 
certain levels. Here's what I found on my 
version. 

Level to pass Incantation .^pell 

Level 1 TOMB 

Level 2 DROWN 

Level 3 OOZE 

Uvel 4 RISK 



After that you're on your own. 



Dennis Gaunt 



More Playing Tips for. . . 



Beyond Castle WoUenstein 

Muse 



Attn: Michael Cook... Regarding Michael 
Cook's questions about Beyond Castle 
Wolfemteitr. you can kill a guard in front of a 
door and still open it. Stand a bit to one side 
of the body and aim your weapon at it, then tap 
the space bar. Repeat until the guard is no 
longer in the way. This is also useful to 'drag' 
dead guards out of sight of other guards. 

The only way to use the dagger is to hit the 
colon (T] key and then stab the guards from 
behind while you are following them. Typing 
the [T] changes your weapon from the gun to 
the dagger. As you overrun guards with your 
dagger drawn, they die. One of the many clues 
the seated guards will give you when you bribe 
them with money (hit I M \) when they ask for 
your pass is to "stab only from behind." 

The toolbox is used on Ux;ked doors by 
aiming your weapon at the door and hitting 
I QT I . This may or may not unlock the door; do 
not let any guards see you doing this or they 
will .sound the alarm. 



Keys are used ([ think) on the circuit breaker 
panel in the room with the four guards. After 
opening the panel type I 6K I . Somehow circuit 
breaker #2 is important (according to a tip from 
a seated guard). If I recall, you do this when 
the alarms are sounding and it will turn them 
off. 

Finally, the room next to Hitler's room is no 
problem. Position yourself in the room below 
the room with numerous guards to the far right 
side of the door going up. When you enter keep 
going straight up; the guard you must answer 
to is always near the top not far from the desk. 

Help ivanted for... 



didn't work for me. Keep up the excellent 
work!. 



Gemstone Healer 



C2) Does anyone know how to "heal" the 
gemstone pieces in Gems tone Healer ? SSI has 
responded to my inquiries twice but they're not 
giving anything away on exactly how this is 
done. Anyone got a softkey tor this one yet'?? 
I can't find the nibble count or whatever. 

*l question about Billy Tesxio 's. . . 

Light Simulator 

COMPUTIST H2. Page 29 

Finally, was the Light Simulator in the 
April, 1987 issue for real or an April Fool's 
joke? I'm not about to enter all those hex 
numbers if not. Is the result that 3-D image that 
was on the cover? Obviously, the accompanying 
text was an April Fool but what about the hex 
dump? 



£ 



/ was assured by a CO/'iZ-ahle backup 
copy of Billy Tessio that the hexdump is 
genuine and a light simulator is the result. 
Gordo Lachancc's amazing update to the 
softkey in the very same issue contributes a 
variation on a theme: the sector-edits do 
something strange to the Light Simulator. And 
if you haven't typed it in, 1 urge you to do so 
just for the fun of it. 

By the way, if you have any other alterations 
for Lighi Simulator, please send them in for 
publication RDEXcd 

Softkey for... 



Moebius 

Origin Systems 



We had our Moebius (Origin Systems) disk 
go bad which was replaced quickly by the 
company for $5.0O. The non-defective disk 
copied nicely with the Ultima /[^controller and 
the sector edits in COMPUTIST #32. The 
original disk wouldn't boot to completion which 
was probably why the deprotection procedure 



Help wanted for.. 



Pool 1.5 



(5) Can anyone help with a 1981 game by 
Innovative Design Software entitled Pool 1.51 
This is an excellent pool simulation game which 
allows the player to adjust all parameters of 
shooting the cue ball. The protection also seems 
quite good, especially for I98I. 

The jacket says 48K Apple, DOS 3,2 or 3.3. 
A bit copy won't work. The only thing readable 
with a sector-editor is track SO, sector $0. The 
remainder of the tracks that are readable require 
the DOS 3.2 option on the Copy II Plus sector 
editor. Tracks $16 — SlDand $22 are 
unreadable and a hi-rcs disk scan shows these 
to be garbage (I think). 

I've tried every DOS 3.2 technique suggested 
inbackissuesof COMPUTIST to no avail, I've 
tried using COPYA with various addresses 
altered also. Specifically, COMPUTIST #45, 
page 6 says to: 

BLOAD MUFFIN 

CALL -151 

1AA9:18 66 2D 60 

SOIG 

When I fried this I dropped intpthe monitor 
at $803, What's wrong? 

X COMPUTIST M5 had a typo. The correct 
run address for MUFFIN is $803, the last 
command should be 803G not 801G. It sounds 
like you have a DOS 3.2 (13 sector) disk. If 
you decide to use a swap controller with Super 
lOB 1.5, you must change the number of sectors 
from 16 to 13 to match the 13-scctor disk you 
are copying RDEXed 

Next, I tried capturing the RWTS and used 
a controller for Twala 's Last Redoubt and a 
Hartley software "B" (COMPUTIST #32) with 
no success. With the latter, i?(//)er/QB just hung 
with the words "Reading" track 3, sector C. 

t Softkey for. . . 



Mission In Our Solar System 

Thunder Mountain 



The Hdiley Project by Mindscape is being 
marketed in this area by Target Discount stores 
under the name A Mission In Our Solar System 
through Thunder Mountain software for only 
$8,001 

The softkey for The Halley Project by Jason 
Rosenwald (COMPUTIST Hi) deprotects this 
very nicely. 
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Playing Tips for,. 



Alternate Reality — The City 

Datasoft 



Here are some coordioates to help you master 
Ahernare Reality courtesy of Pirates Harbor of 
Westchester. 

Guilds 



Thieves 


35n 


44c 


Blue Wizards 


48n 


m 


Light Wizards 


,5ii 


3e 


Green Wizards 


^mn 


*% 


Red Wizards 


15n 


48e 


Dark Wizards 


22n 


34e 


Star Wizards 


12n 


28e 


Wizards of Chaos 


60n 


5ie 


Wizards of Law 


50n 


62e 


Guild of Order 


5ffln 


58e 


Physicians 


15n 


6e 


Assassins 


3n 


56e 



Alpha Omega Healer 



21n 



5e 



Death traps 



5n 

7n 



42e 
48e 



The Hacksaw 



Softkeys far. . 



Dm Eggs 

Micro Lab 



Crisis Mountain 

Micro Lab 



Micro Lab's protection schemes on Dino 
Eggs and Crisis Mountain are minimal and 
simple to remove. 

To convert them to a COPY A format, disable 
the DOS checksum and epilogue cheek and run 
COPYA. This basic technique will copy many 
programs, 
POKE 47426,24 
RUN COPYA 

This will make a copy oi Dino Eggs ox Crisis 
Mountain. After you have accomplished that, 
you must modify the program{s) to read the 
regular DOS data marks, which requires a 
sector- editor. 

Make the following modifications: 



Trk Set Bytes From 

$00 $09 $35 D5 

$91 9E 

■•$94- IS 60 

$9B E7 



To 



DE 

DE 
EABD 

AA 



Their modified RWTS still de-nibblizes the 
data abnormally, so to normalize it, make the 
following modifications: 

Trk Set Bytes From To 

$00 50C ?FB- BF lA 
$00 ?0E $38- 4C 00 BB 



BC19 
0&B0BE 



Softkeyfor.. 



BCs Quest for Tires 



Track $21 is a nibble-count track and 
contains no data needed by the game. 
Otherwise, the game is standard DOS 3.3. 

Copy the disk (skipping Track S21) onto a 
blank. Or, if you want to modify the original, 
just use Ba^o/r/vci^'/Af/T" utility, and format 
track $21 on the original disk, 

WARNll\G: Trying this on the original is not 
safe and it would be better to try it on a bit copy. 

Now, the disk can be copied by COPYA , but 
it won't boot because of the nibble-count. We'll 
just NOP the JSR to the nibble-count by 
changing the following bytes with a 
sector-editor. 



Trk Set Bytes From 
$06 $07 SE8- 20 00 96 



To 



EA EA EA 



That's it. 



Peter Wilding 



It's unbelievable! I can't believe the new 
COMPUTIST. There was so much information 
that I was in a reading frenzy. I couldn't fathom 
that amount of material in one place. Keep it 
up, I prefer seeing a lot of softkeys in mass 
confusion than the 5 or 6 softkeys in previous 
issues, 

I would like to thank Dudley Brett for his 
insight into MECC programs, it was a big help. 



More Playing Tips far. . 



Beyond C^tle Wolfemtm 

Muse 



Attn: Michael Cook... Arid here's 
something to help you with Beyond Ca.Ktle 
Wolfenstein. 



D To switch between the dagger and the gun, 
type [7] a colon. 

n To use the dagger, switch weapons (make 
sure nobody sees you), point the dagger, 
and simply run into the guard you're 
killing from BEHIND. It's quieter thati 
shooting. 



a To use the toolkit, type I BT 1 . This rewires 
the alarm sy.stem. You've just gotta find 
the circuit breaker, I haven't yet found a 
use for the keys, but to use them you must 



type [0KJ . 

n One more thing: To DRAG a body away 
fromacloset or just out of sight, stand next 
to it, point your gun in its direction, and 
press the space bar. 

Keep Hardware Corner going. Some of the 
boards which Bobby mentions are really neat 
(Ram works 11! does what Instant On does, but 
for 200 dollars more). These cards are well- 
worth the price, and I think that they will all 
be very useful to those people who are curious 
and want to learn a little more about their 
computers. 



William Green 



I would like to share with your readers the 
following softkeys for many of the new 
Aetivision releases including Game Maker, 
Hacker II, Little Computer People, Great 
American Road Race, Spindizzy, Master of the 
Lamps, and Rocky Horror Show. 



Softkeyfor... 



Aetivision 

software... 



Note: This came from the soft key in 
COMPUTIST #30 but the reader did not reveal 
what the original code looked like. 

Please for all of you future writers. Do that! 
The code moves around not (mly on different 
games from the same company but sometimes 
even on the same game. Quite frustrating. 

Search for bytes A9 56 85 FD A9, The entire 
string starts and ends like this: A9 56 85 FD A9 
08 C6 FC D0 04 38 2A 25 FC, 

This entire string must be bypassed. All $38 
bytes of it. 

Starting at the SA9, put in A9 FF IS 90 3D, That 
should put in a jump to the location following 
the 2A 25 FC code. 

The following list shows where I found the 
pattern on my disks. 
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Quick Sojikeys for... 




Game Maker 


Track $21, sector $05, bytes $54- 


58, 


Hacker II 


Track $16, sector $09, bytes $D©- 


-D4, 


Wle People 


Track $00, sector $0A, bytes 573- 


-77. 


Great Road Race 


Track $O0, sector $OA, bytes SC2 


-C6, 


Master of the Lamp 


Track S0O, sector 0B, bytes $28- 


2C. 


Splttdizzy 




Rocky Horror Show 



Track $1C, sector $03, bytes $58-5C. 
iThaf s it. 



Elvin Chan 



Help wanted for... 



Under Fire: The Campaign 

Avalon Hill 



Under Fire by Avalon Hill is the best 
computer tactical wargame that I've found and 
the only complaint is that it had a very, very 
slow DOS. The softkeys from COMPUTIST 
No, 37 proved to be very helpful and 1 was able 
to use a faster DOS. 

Since then I have also purcha.sed two other 
expansion disks. The same softkey only works 
however with the first Extended Capability disk. 
The Campaign (Extended Capability II) disk 
seems to have a different protection scheme. 
The softkey transferred all the files correctly 
but when I tried the disk, the game went 
haywire. It's my guess that something was 
hidden on the 23rd track but 1 can't confirm this 
nor do anything about it. 



C2) I was wondering if John Howard, who 

wrote the softkey for Under Fire, or anybody 
else could help me with this situation. 



Bill Rossmann 



Please ask the readers who send in softkeys 
to include the manufacturer. This helps when 
newer software is released to give a starting 
point. Here are two softkeys that worked just 
by using that information: 



t Softkey for.. 



Bop W Wrestle 

Mindscape 



25, 



Use Infdirator in COMPUTIST j?47, page 



Softkey for. . 



GFL Championship Footbali 



A division 



Use Labyrinth COMPUTIST #46, page 4, 
I found ail the data on track $1B, sector $0©, 
bytes $54—95, 

Also helpful is putting the name, company, 
and issue number into an Apple works data base 
for quick reference. 



Robert Paquette 



Help wanted for.. 



Voiiars and Sense 



I have been running Doilara and Sense on 
a Franklin Ace 1<M>&, using a boot disk copied 
with Copy II Plus, not wanting to use my 
original disk. It has worked fairly well for two 
years but has a subtle form of error. It 
occasionally loses an entire transaction or It 
loses the text entry but not all of the sums and 
postings asst>ciated with it. These errors are 
hard to find and correct. When it happened 
twice in one tnonth I decided to go back to using 
the original boot disk and a fresh copy of the 
system disk. It is too early to tell if this has 
cured the problem, 

(2) Do you or your readers know if this 
can happen due to a faulty boot disk, or is it 
inherent in Dollars and Sense itself? 
I see that you have removed Dollars and 



Sense from your 'Most Wanwd' list. May I vote 
for putting it back on. One needs a more reliable 
way than a bit copier to make a copy if the 
possible resultant errors are so subtle. 



Thomas Beach 



Double Your F-8 ROM Space 
Without Motherboard surgery 

The F8 ROM in my Apple II Plus recently 
went bad, so I decided to replace it with a 
double F8 image in a 2732 EPROM, as 
described in Ray Darrah's article Double Your 
ROM Space in COMPUTIST #19. 

There was a difficulty, however, as the 
74LS02 chip he used to invert the signal to pin 
18 of the EPROM appeared to have no free 
NOR gates on my motherboard. In addition, I 
did not tike the idea of cutting traces or 
soldering wires directly to the motherboard or 
EPROM chip, especially when it seemed 
avoidable, 

I used the following modification to his 
procedure. The requirements are the same as 
listed in his article, except you also need two 
24-pin IC sockets, and one 14-pin IC socket. 
Low profile sockets are preferable. 

To invert the signal to pin 1 8 of the EPROM, 
1 used the 74LSOO at position A2 on my 
motherboard. 

Two dual-input NAND gates in this chip 
have both of their input lines connected to 
ground, but the outputs have no connection. On 
earlier revision motherboards these outputs 
were connected to 'soft -l-5V\ The NAND gate 
I used has its inputs on pins 9 and 10. and its 
output on pin 8. Check your motherboard (top 
and bottom) to see that there is no connection 
to pin 8 to be sure this gate is free to use. By 
connecting one input to -t-5V, the gate can be 
used as an inverter. The other available gat& 
has inputs on pins 12 and 13, and putpiit on pin 
11. 

Instead of wiring the F8 image select switch 
directly to the 2732 EPROM as described in 
the original article, I wired it to a 24 pin IC 
socket, as shown in the diagram. Carefully bend 
pin 2 1 outwards and solder a wire from the pin 
to the pole of the switch. The wires from the 
other two connections on the svi'itch are 
soldered to pin 12 (ground) and pin 24 (+5V) 
of the EPROM socket. Do not bend these pins! 
The wires should be soldered as close to the 
socket as possible, using a minimum amount 
of solder. Pin 1 8 is also bent outward and a wire 
is soldered on. When finished, you must be able 
to insert the 2732 EPROM into the new socket, 
and insert thi.s new socket into the old F8 ROM 
socket on the motherboard, so keep this in mind 
when bending pins and soldering wires. 
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Three socket wiring schematic for use of 2732 EPROM with double 
FS image. Requires no soldering or trace cutting on the motherboard 
or EPROM chip. 



SPOT 
Switch 
witn no 

center 
position 




GND 



+5V 



socket lor 

2732 EPROM 

with double 

F8 image 



Pin bent 

outward: trri 



Unbent pin 
witti wire 
soldered 
on next to 
socket: ^■^ 






+SV 



•ockat lor 
74LSD0 

A2 



8W 

9 
iO 

Free I4AND gale in the 
74LSaO at position A2 
Is used to invert the 
signal Irom ROM pin 18. 
This gats was used on 
early Apples, but Is free 
to use on later revision 
motlierboards. 



The 2732 EPROM requires a signal to pin 
18 (ROM inhibit) which is inverted as compared 
to the signal required by the ROMs used in the 
Apple II. 

All of the ROMs have the same signal on pin 
18, so I used a .second 24-pin IC socket under 
the F© ROM to get the signal (do not bend pin 
18 on this socket) . The signal is inverted by the 
NAND gate in the 74LS0O at A2, 

Access to the NAND gate is gained by 
preparing a new socket for the 74LSO0, 

Pins 8, 9, and 10 are carefully bent outward. 

Pin 1 is wired to pin 14 (+5V) on this same 
socket (do not bend pin 14). 

Pin 9 receives the signal from the F0 socket, 
and pin 8 provides the inverted signal to the F8 
socket. 

Place the 74LS0O in this new socket, and 
insert the new socket into the old socket at 
position A2 on the motherboard. 

That's it! There is no need to cut the trace 



leading to pin 18 of the F8 ROM socket, as 
described in the original article, 

a note on Earl Taylor^s^.. 

Towards a Better F8 ROM 

COMPUTIST ff\9. Page 18 

If you use the modified F8 ROM described 
in Earl Taylor's article "Towards a Better F8 
ROM" (also in COMPUTIST i{'19) you should 
note that there is a discrepancy between the 
'new ROM source code' listing, and the hex 
code listed in the instructions for preparing the 
ROM, 

The Source Code listing has byte $FF0F as 
DF, resulting in a new cursor which is an 
underline character, as described in the article. 

But the hex code shows the corresponding 
byte ($2FOF) as FF, and the new cursor would 
be a question mark, unless you have a 
modified character generator ROM, in which 



case the cursor will display as whatever the FF 
character is in that ROM. In my modified 
character ROM, the FF character displays as a 
checkerboard block, similar to the //c cursor. 



Lenny Schmidt 



More Playing for.. 



Beyond Castle Wolfenstein 

Muse 



You can move the bodies of the SS guards! 
Simply stand to one side or below them (not 
touching them), then point your gun toward the 
guard and press, I SPACE) . This will move the 
body to where, if you press I SPACE I again, 
you can search him. 

C2) Tve played the game many times myself 
and I always find it a challenge. However, I 
don't know how to use a tool kit. Can you get 
inside the room Hitler is in? If so, then how? 
What should you do if you can get in? 



Mr. E. Lau 



Softkey for.. 



Walt Disney Card & Party Shop 

Bantam Electronic Publishing 



Ll ] Use Locksmith FASTCOPY to 

copy side A and side B. 

I_~ I Sector-edit side A: 



Trk Set Bytes From To 



|0A $08 $05- 



A9 01 8D CF 03 A2 I 
01 0A 68 



I4C: 



Softkey for... 



Wait Disney Comic Strip Maimer 

Bantam Electronic Publishing 



I ^ I Use Locksmith FASTCOPY to 
copy side A and side B. 



Sector edit side A: 



Trk Set Bytes From To 



m $0E $05- 



A9 018DCF05.AZJ5I.4C 
00 0A 68 



This disk is deprotected and CQPK4 -able. 



18 



COMPUTIST #50 



December 



Scuzzy Port 



*IIgs Softkey for. . 



Deluxe Paint If 

Electronic Arts 



Make a backup copy of your Deluxe 
Paint 11 disk, ignoring the bad block errors. 



Using a blocic-editor, scan for the 
following hex sequence: 08 C2 30 SB 0B DA 5A 48 
AB3B3e, I found it at block S29 1, byte $1B3. 
Change the 8 to 5 B and write the block back 
to the disk, 

1 ^ I Scan for the following hex 

sequence: A8 F0 02 80 IF. i found it at block 
$412, byte S169, Change the A8 F0 02 to EA F0 
00 and write the block back to the disk. 

*ngs Softkey for... 



Instant Musk 



[^H 



Make a backup copy of your instant 



Music disk, ignoring the bad block errors. 



L^J 



Using a block-editor, scan for the 
following hex sequence: A8F002 80. I found it 
at block $111. Change the A8 F0 02 to EA F0 00 
and write the block back to the disk. 



Change block $014. byte $1DD 



from 08 to 6B. 

Deluxe Paint U and Instant Music are now 
unlocked and may even be used from a 
-RAMdisk or hard disk! 



Roy Newberry 



Softkey for. . 



Print Shop Grapiiics Library 

Holiday Edition 



Broderbund 



■ Requirements; 

D COPYA 
G sector-editor 
D disk-searcher 

The Print Shop Graphics Library Holiday 
Edition is a collection of graphics for just about 
every holiday of the year. 



Unfortunately, the second side of the disk is 
copy protected and track $22 is difficult to copy 
even with a nibble-copy program. 

Fortunately for us, Broderbund used the same 
copy protection system as is used on the Color 
Enhanced Print Shop (sec Jason Rose nw aid's 
softkey in COMPUTIST MAfi). The only 
difference is that the offending byte lies on track 
S©2, sector S06, byte $19. A simple sector edit 
of this byte from A0 to 60 will solve the 
problem. 

I ^ I Copy both sides of the original disk 

with COPYA or another whole-disk copy 
program.(I use the F/iSTCOFV program from 
locksmith 6.0). 



Use your favorite disk-searcher to: 
for the byte sequence A0 00 A9 FF and 



scan 

change the first byte to 60 



Brian A. Troha 



nigs Softkey for.. 




■ Requirements: 

C Apple Ilgs 512K 

[I Pro DOS block -edit or with search ability 

■ Tools I Used: 

D Copy II Plus ProDOS: was used to make a 

copy of the V/i" disk, 
D SAND.PRODOS: from Cutting Edge 

Enterprises was used to search the disk and 

make the block-edits. This program was 

invaluable in the procedure. 

Sierra has come out with a new game called 
Thexder and it is THE arcade game for the 
Apple Ogs, I found only two problems with the 
program, one major and one minor. 

First, the program lacks joy.stick control, 
which is sad because the game is built for one. 
You could control all movements with the 
joystick and have button (Z) fire, while button 
1 would control the transformation in and out 
of the 'jet mode.' 

Second, the program requires a KEY DISK 
to play. This means the disk is copy-protected, 
so if the original fails you are out of luck. I leave 
it to you. to figure out which is the major 
problem and which is the minor one. I will 
explain how you can fix one of these problems. 

Like most programs for the Apple Ilgs, 
Thexder follows the same type of disk 
verification, that is: The program comes on a 
3'/^" di.sk and is protected by checking for a 
'BAD BLOCK', block $634 in this case. The 



program will check for the error, and if not 
found 'knows' it's on a copy. The NOTES sheet 
says you can upload the program to a hard disk, 
but you still need a KEY DISK. I was able to 
eliminate the need for any type of key disk. 
To find the protection I loaded the 16-bit 
system file to a RAMdisk and then searched the 
disk for ProDOS 16 calls (22 A8 00 El [22]), 
keeping an eye open for block-reads. I came 
across the following on block S562: 



A9 34 06 


LDA#$0634 Block to check for 


8D D2 10 


STA$10O2 Store in parm table 


22 A8 00 El JSLE100A8 PRODOS 16 ML 1 


22 00 


0022 Comandrt (read block) 


CC10 00 


0010CC Farm table local ion in mem. 


00. 


00 End of MLI parm table 


B0 06: 


Be5S38 Brancb on BAD read 


22 0D 10 00 JSL00100D "INSERT MASTER Dl SK" 


80 00 


BRAS08 Branch AllVAVS to check start 


C9 27 00 


CMPH0027 


F0 06 


BEQ$43 


22 0D10 00 JSL00ie0D 


80 05 


BRA$08 


A9 35 05 


LDAM635 Check next block 


8D 02 10 


STA$10O2 Store in partn table 


22 A8 00 El JSLE100A8 Read the block 


22 00 


0022 


CC 10 00 


0010CC 


00 


00 


90 06 


ECC$5B Branch on GOOD read 


22 00 10 00 JSL00100D 


80 AO 


BRAI08 


22 71AZ00JSL00A271 


AD CA 10 


LDA510CA 


8D CC 10 


STAJ10CC 


A9 34 06 


LDAn0634 Check for bad block 


8D D2 10 


STA$10D2 


22 A8 00 El JSLE100A8 


22 00 


0022 


CC 10 00 


0010CC 


00 


00 


90 04 


BCC$7B Branch on GOOD read 


22 3A 10 00 JSL00103A ■'INSERT GAME PIAYDISK" 


A5 0E 


LDA$0E 


A5 10 


LDXSIB 


85 00 


STAS0e 


85 02 


STXS02 


A0 00 04 


LDY#$0004 


B7 00 


LDA[00],Y 


29 FF 7F 


and#$7FFF 


97 00 


STA[00].¥ 


18 


CLC Set flag for PASS 


Ae 


PLB 


66 


RTL Return to cal ler 



This is the heart and soul of the protection, 
as you can see, the routine checks for the bad 
block and then makes sure that the next block 
is readable. If both cases come out 'true', the 
program starts up and mns the game. Otherwise 
the program will a skyou to " I NSERT THE MASTER 
DISK" and press I RETURN) . If you insert the 
key disk the program will check it and then ask 
you to " I tJSERTTHE GAME PLAY DISK", and press 
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I RETURNI . Otherwise the check is run over 
until it finds the key disk or you press I ESC I 
to cancel the loading. After a lot of looking and 
some luck, I found the original call is make 
from the very beginning of the game and is in 
the form of a JSL O0OF42 (relocated later to 
JSL G)30F42). With this in mind the cratk 
becomes very simple: 

Bl.ock Bytes From To 

J55C 



*ngs Softkey for... 



.S55 



22 



AF 



What the edit does is change the JSL 
0OOP42 to a LDA $0©©F42, thus overwriting 
the call and the game will run. Even when you 
change the volume name or upload the game 
to a hard disk you will never need a key disk. 
My first attempt was to edit block $562 and 
change the first JSL E10OA8 to CLC, PLB, 
RTL, This method would bypass the check for 
the bad block ($634), but if you change the disk 
name you still need a disk called /THEXDER 
online. However, ufith the above edit, even that 
is no longer needed. 

The only tip I will add is: when playing the 
game, upload the files to a RAMdisk (if 
possible, ie: if you have the memor)') and the 
program runs without delays when loading in 
new information. The time spent copying the 
files to the ram disk will be justified by the 
increase in the overall speed of the game, 

Softkey f^r.,, 



Realm of Impossibility 

Electronic Arts 



■ Kequirements: 

D Apple II with 64K 

a Blank disk 

D Sector-editor with disk search 

n Fast copier {Copy il plus or equiv,) 

D COMPUTIST #49 

Realm of [mpossibility (ROI) is a newer 
release from Electronic Arts (EA) with the new 
low price of $14.95. In the game you nin 
around collecting spells, keys, and crowns 
trying to complete all thirteen dungeons. Even 
with the affordable price, EA still insists on 
using their infamous protection routine. 

Using the same information in the softkey for 
Araicfox in COMPUTIST #49, page 16 h's 
easy to crack ROI. Again the calls to $569 are 
required for the game to run right, A list of edits 
follows: 

Trk Set Bytes From To 



Ml 


$-0B $4D- ■? 


18 60 AB 




$52- ' 


18 60 m 


$01 


$0E $4D- ? 


18 60 46 




$52- ? 


18 60 4B 


$01 


$9F $00- ? 


18 60 DO 




S6F- ? 


18 m DD 



Grapliicwriter IM & I.IR 

DataPak 



■ Requirements: 

n Apple //gs 5I2K 

D ProDOS block-editor (SAND.PRODOS ) 

D Copy II Plus 

Graphicwriter (GW) by DataPak is a word 
and graphic processor designed for the Apple 
llgs. This program can do color separations for 
desktop publishing. One unique feature is how 
graphics are treated. The graphics sections are 
called regions, and you can move and edit them 
just like text and place them anywhere on the 
screen. Although both versions 1.0 and 1,1 
don't have the final print routines the program 
is sfill quite good. When version 2,0 comes out, 
DataPak says, they will ship you a copy free 
of charge if you register your original , Other 
than that, there is one major problem with GW, 
it's copy protected. 

Most new programs for the ligs allow you 
to copy them but you need a 'key disk' 
(original) to 'unlock" the system. However, 
with GW the program only bombs into the 
monitor, this can be both good and had. When 
GW crashes into the monitor the super hi-res 
screen was on, to switch to text mode simply 
type LSTJ I RETURHl , Now you can see where 
the program died and the contents of all the 
registers. 

The program disk actually has an 
unformatted TRACK which could leave 8 to 12 
blocks unreadable depending on which track. 
With version l.fl blocks $0C through $17 are 
bad, while on version 1 . 1 it's blocks $634 
through $63 F, The protection routine is called 
after everything has loaded and just before the 
program starts. I will use version 1.1 as an 
example, but the method will apply to version 
1.0 also. 

The program file starts out like this (the code 
is in memory block S03. IE 3/DL to see the 
following); 
00 : 22 8A 0D 00 This tjike vill chqitge when yilocaicd, 

06:4C2C5F 

The first jump subroutine long (JSL) loads 
in the program and sets everything up. Then 
you come to the jump $6F2C, a look at this n^w 
code follows; 



6F2C: 


A9 7E 06 


LDA )?$067E 


6F2F: 


85 A4 


STA SA4 


5F31: 


A2 8A06 


LOX H068A 


6F34: 


A9 4C 00 


LDA M004C 


5F37: 


20 75 05 


JSR $0675 


6F3A: 


8D 75 6F 


STA $6F75 



value is stored at S6F75, thus overwriting the 
endless loop that's there now. So lets cheek out 
the code at $675 



675 


A0 00 00 


LDY /f$0000 




678 


91 A4 


STA (A4).y 


: A4+Y=57E 
A=004C 


67A 


G8 


INY 




67B 


8A 


TXA 




67C 


91 A4 


STA (A4) . V 


; A4+Y=67F 

A=058A 


57E 


60 


RTS 




57F 


2A 


ROL 




580 


2A 


ROL 




581 


2A 


ROL 





Look what the code does, first it stores a 4C 
00 at $67E and then stores a 8A 06 at $67F. So 
the RTS is overwritten with JMP $068A, 
looking at the next step: 



58A 


A9 m 02 


LDA C$0200 


68D 


A2 85 06 


LDX nm%b 


690 


20 7B IC 


JSR$1C7B 


693 


AD 37 06 


LDA S0687 


696 


48 


PHA 


597 


AD 85 06 


LDA $0685 


59A 


43 


PHA 


69B 


A2 92 20 


LDY SS2002 


69E 


22 00 00 El 


JSL $E10000 


5A2 


20F5 1F 


JSRJ1FF5 


5A5 


8D 83 06 


STA $0683 


6A8 


C0 00 00 


CPV #$0000 


This is where the patch will 


6AB 


F0 03 


BEQ $5B0 


6AD 


4C1A07 


JMPS071A 


680 


E0 43 06 


CPX M0643 


Check passed. 


get right vak 


5FE 


A9 BA 70 


LDA M70BA 


701 


48 


PHA 


702 


A9AAD5 


LDA #$D5AA 


705 


SF 6A 0F El 


STA $E10F5A 


709 


AD 87 05 


LDA $0687 


70C 


48 


PHA 


70D 


AD 85 06 


LDA S0685 


710 


48 


PHA 


711 


A2 02 10 


LOX «1002 


714 


22 00 00 El 


JSL $E10000 


718 


68 


PLA 


719 


60 


RTS 



A=?70BA 

Starting with S6FE you can find the code that 
gets the right values and returns to the caller, 
I changed the first conditional branch to a 
branch always to the code at $6FE, Your copy 
of graphic writer will now IxMt and run like the 
original, but without any checks for the bad 
tracks or blocks. The actual edits for both 
version are very close; 

For version l.OR: 



6F74: 4C74 6F JMP $5F74 

You see a JSR to $675 and upon return a 



Block Bytes From 



$163 IFB- F0 03 



To 



I4F 
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For version I.IR; 

Stock Bytes From 
H5C SF9- F0 03 



To 



80 51 



For version 2,0, that is due out soon, a 
similar trick should work. Find the start of 
16-bit system file, then find the first JMP, 
Follow the code that has similar listings as I 
have shown. Or use a bloek-editor with search 
ability and search the disk for C0 00 W F0 03 AC. 
figure out the correct displacement and 
overwrite the BEQ (F0 03) with a BRA (80 XX). 
When I get the new version (version 2.0) i will 
send the information in, so that other readers 
can make there own backups. 

After looking at (and trying to understand) 
the softkeys for Ilgs programs in COMPUTIST 
#4S, I have a few additions I would like to pass 
on. 

t *//gs Sofikey Addendum for... 



Backer If 

Activision 



First 1 had a different set of edits for Hacker 
II. they simply ignored the result of the disk 
check. While Hacker 11 would run using this 
edit, it was the addition of the edits in 
COMPUTIST #48 that actually disabled the 
block read. Just add the following two edits; 

Bloek Bytes From To 



S3D3 

J451 



$70- 
$70- 



F0 \2 
F0 12 



EAEA 
EAEA 



*Ugs Sofikey Addendum for... 



Musk Construction Set 

Electronic Arts 



With Music Construction Set, I looked at the 
code before and aftci' the patch. I found you 
really only need to change one byte, I chose 
to NOP the call to the protection because it will 
fail anyway. You can NOP the codes here 
because this is NOT a true 16-bit program. 
MCS boots and runs under ProDOS 8 and is 
not relocatable like $B3 type (16-bit program) 
■files. 



Bloiik Bytes From 



$43E SCA- 



To 



20 00 BF C5 42 
49 20 C2 4A 90 



EA EA EA EA EA 
EA EA EA EA 80 



t *Hgs Sofikey Addendum for. . 



Shanghai 

Activision 



that $5D09 must hold a value of $000 1 . By 
changing three bytes I stored the correct value 
at $5D09 and overwrote the call to the disk 
check routine. 

The edits arc shown below with the changes 
to the dissassembly so you can see what's going 
on. 

From: a0 00 00 LDY ff$0000 
22 74 78 00 JSL $007874 
8D 09 5D STA $5D09 

To: A0 01 00 LDY ff 50001 

AF 74 78 00 LDA $007874 
8C 09 5D STY $5D09 



Help wanted for.. 



Block Bytes From 



$243 



$1E5 


m 


$1E7 


22 


$1EB 


80 



To_ 
01 

m 



t *Ilgs Sofikey Bug for.. 



Draw Pius 

Activision 



Lastly in COMPUTIST #49 1 state that to 
deprotect Draw yuu should change 39 bytes to 
EA's, well it worked for me. Later I learned 
this is not the right approch, because Ilgs 
programs are written to be relocatable (with 
built in relocation tables) some of the EA's will 
be changed to other values. To fix this I changed 
all the bytes back to their original values, then 
changed the first conditional branch to a branch 
always to the 'ok to start' portion of the code. 
I am sorry for the mistake, but at least I can 
show the right patch. 
Block Bytes From To 



$516 $34- 



D0 23 



80 21 



After checking the code on Shanghai. I found 



I must thank all those people who sent in the 
softkeys, with out their information I would not 
have been able to find the above edits or make 
backups of those programs. Here arc some tips 
(I found out by trial and lots of errors) for 
defeating 3'A"' disk protection: 

For subroutine calls, change JSR (2(T) to 
LDA (SD) and change ISL (22) to LDA (AF) . 
This allows replacing calls with harmless load 
accumulator instructions. 

From: 20 45 60 JSR 6045 
22 BF 00 00 JSL00D06F 

To: 8D45 6D LDA J6D45 
AF BF 0D 00 LDA $00D0BF 

For Conditional branches (BCC, BNE, etc.) 
you will have to change them to NOP's (EAEA) 
or BRA XX (80 xx) depending on the situation. 



Mathew J, Tomczik 



UMma m 

Origin Sy.stems 



<2) I have a question about the first boot 
strap of the program Ultima III. The program 
does not seem to work on my //c but docs work 
on my friend's Apple //c. 

If anyone can help me on this it would be 
great. 



David G. Alexander 



Sofikey for, , 



Game Maimer 

Activision 



Here is a crack tor Gary Kitchen '.v Game 
Mater which was on the Most Wanted List in 
COMPUTIST #48. 

The protection: a disk check for what appears 
to synchroni7,ed tracks and is the same routine 
as in Great American Cross-Count ry Road Race 
in COMPUTIST f>^9. page U. However, the 
routine is located on track $21 , sector .S5. and 
starts at byte $5 1 . The crack is to change bytes 
S51— 91 fromBD89C0A9 55 ... 10 FB to all EA's 
and bytes $92—95 from 38 2A 25 F.C to.EAEAA9 
FF. 

Sofikey for... 



Microzine #17 

Scholastic 



The protection scheme on Microzine // 7 is 
different from that of previous Microzines. 

The primary protection consists of address 
trailers changed from DE AA to AB FF. The 
secondary protection is a binary boot file 
HELL03 which appears to perform a disk 
check on track $23, run an Applesoft file 
HELLO if the check is successful and reboot 
if the check is unsuccessful. 

Copy both sides using COPYA with $B942 
changed from $38 to $18 (POKE 47426,24 ignore 
altered address trailers) then sector-edit side 1. 



Trk Set Bytes From 



•'m 



S0 S3 $91 


AB 


DE 


S0 S3 S9B 


FF 


AA. 


S0 SB S42 


34 


m 


SI S7 S7A 


B3 


A0 



Edits 1 and 2 patch DOS to read the normal 
address trailers. Edit 3 converts the boot file 
type from binary to Applesoft. F^it 4 changes 
the boot file name from HELL03 to HELLO 
by deleting the "3" at the end of the llle name. 
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Softkey for. . . 



Robot Odyssey I v2.0 

The Learning Company 



This robot construction game by the Learning 
Company is the Best! Not to mention its 
educational value! 

Robot Odyssey I {Version 2.0) is protected 
almost the same as the previous version 
discussed in COMPUTIST #28, page 11. 

Using the information in that issue and a 
sector editor with a search string function, 
(Copy 11 Plus v7. 4) I found the protection on 
track" $07, sector $04, byte $99. 

There are three (3) sides to the new version 
(A, B, & C), and a demo side that is not 
protected. Sides A, B, & C had the protection 
at the same locatitm. You must deprotect all 
three sides or the soldering iron, in the program, 
will not work. 

Using what has gone before and what I 
discovered, here are the instructions. 



LTD 



LOAD COPYA 



Load in COPYA. 



mill 



Add the following lines: 



199 POKE 47426,24 
249 POKE 4742G,S6 
259 POKE 4742G,SG 



Copy all three sides with this 



modified COPYA. 
RUN 



[^m 



Use your sector-editor to change the 



following on all three sides (A, B, & C). 



Trk Set Bytes From 



$07 $05 199 



To 



18 



33 



I ^ I If the string 18 BD 88 is not at byte 

$99, then you must use your sector-editor's 
search function (called 5C4N in Copy !I Plwi' 
sector-editor) to look for the string 18BD88 and 
then change the 18 to 38. 

You now have a CQPK4-able and workable 
Robot Odyssey v 2, 0. 

regarding J. Howard's softkey for... 



Under Fire 

COMPUTIST #37, Page 11 



(2) Now I have a question. What are the 
names of some DOS Utilities that move DOS 



into the language card, as required to deprotect 
Under Fire (Avalon Hill), in COMPUTIST 
*37, page 11, top left? 



Tamaki Murakami 



Some kudo's for 
The Senior PROM 

First of all, I must say that many people 
haven't realized the importance and the power 
of Senior PROM. This piece of hardware 
enables you to softkey programs that use 
.sophisticated protections in a few steps. This 
is a must especially for beginners, who might 
not even know what RWTS means. 

Also, 1 must ask why there aren't more 
softkey s that utilize Senior PROM in this 
m'Agazmc''! Senior PROM' i, capability of being 
able to read with modified DOS and write with 
normal DOS is a help for all novice users as 
well as for hackers. 

Softkey for... 



Amazon 

Spinnaker 



My version of Amazon has protection only 
on Side 3, the boot side. Using die nibble option 
of Senior PROM, I found that odd tracks are 
normal DOS 3,3 format. On even-numbered 
tracks, however, the prolog bytes were D4 M 
96 instead of the normal D5 AA 96. 

As explained in the article in COMPUTIST 
#39, this game's RWTS can read both normal 
and modified DOS tracks; therefore, 
normalizing the modified tracks won't cause 
any trouble at all. 

First, copy all odd-tracks with any fast-copier 
or bit-copier. I suggest one that can skip 
EVEN-tracks, 

Then choose the 'Alter Prolog Bytes' option 
from Senior PROM's main menu and enter D4 
AA 96 D5 AA EB. 

Then choose the 'Copy Disk' option to 
duplicate even tracks. This automatically reads 
with modified prolog bytes and writes with 
normal bytes, tt'.s rather a tedious routine to 
copy only even tracks because Senior PROM 
has no increment tracks option. 

This program can be softkeyed if you are able 
to read with modified DOS and write with 
normal DOS through assembly language. But 
for novices. Senior PROM i& much faster and, 
most importantly, easier. The documentation 
that accompanies the hardware is worth the 
purchase by itself, and all the utilities in ROM 
are just too convenient. 

As Bob Verplank in COMPUTIST #42 



pointed out. Senior PROM deserves more 
po.sitive reviews. 



Step-by-^sti^ 

With any copier, copy all odd 



[T 



tracks. 

I ^ I From ^enmrf/JOA/'s main menu, 

select 'Alter Prolog Bytes' option and enter: 
D4 AA 96 D5 AA EB 



\^ 



Choose 'Copy Disk' option from 
the main menu and copy even tracks on the Side 
3 (boot side) of Amazon. 



IZ 



Enjoy the softkeyed version of 



Ama^onl 



Oick Lavallee 



iigs Softkey for. , 



The Pritttshop (ProDOS 8 vl.4) 

Broderbund 



■ Requirements: 

C ProDOS sector-editor for V/i" disks 
[BYTEZAP.PRO modified as in page 30 
COMPUTIST #48, Mark Swanson). 

n Disk-to-disk copier for 3 'A" disks {Copy II 
Plu.s 7.4, Diversi-copy 3.2, etc.). 

D. Blank 3'/i" disk. 

Step-by-step 



I—* 1 Copy Jhe Print shop di,sk to disk. 

I_~ I Place the original in a safe place. 

I_? I With a 3 '/j" ProDOS block-editor 

make the following edit: 

Block Bytes From To 

$2F ?37 48 60 

Note: If you don't happen to have a S'/i" 
disk-editor but you do have a S'i" disk- 
editor, here's another way to cumplete the 
softkey. 

■ Requirements: 

D ProDOS-formatted VA" di.sk. 
D Sector-editor for 5 '4" disk. 

Complete .steps #1 and #2 above then 
continue with step #3 below. 

I ^ I Copy the file MF from the duplicate 
3'/^" disk to the SW" formatted disk. 
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Search the 5W" disk for the string 



48 C9 0a 00 
l_? I Change 48 to 60, 

I ° I Copy the modified MF file from the 

5Vi" disk to the 3V4" duplicate disk. 



I got the following softkeys from MAUG on 
CompuServe and thought that other readers 
might benefit from this information. 1 have tried 
these and they worked on my version of the 
programs. 



*llgs Softkey for.. 



Pritttshop GS 

Broderbund 



Change: 

B.loc.N Bytes From 



To 



$2F S7E- 20 4F57 



20 57 68 



*llgs Softkey for. . 



Draw Plus 

Activision 



Change: 

Block Bytes 

i516 J20- 
$35- 
$56- 
$A9- 



From 



2e AD E8 0C C9 
23 AD 84 00 48 
02 AB 60 E2 20 
18 FB C2 30 0B 



To 


00 AO E8 0C C9 


00 AD 84 00 48 


00 AE 60 E2 20 


6B FB C2 30 0B 



*IIgs Softkey for.. 



Reader Rabbit 

Learning Company 



Change: 

Block Bytes From 
$041 $125 F0 



To 



*IIgs Softkey for. . 



Writer's Choke Elite 

Activision 



Change: 

Block Bytes From 



To 



$523 S73- C9 07 00D0 01 EAEAEAE/^EA 



James Slate 



I used the Spindizzy softkey (COMPUTIST 
tfA%) to crack two other Activision programs. 



Softkey for. . 



Aliens 

Activision 



Fast copy or COPYA both sides of 
Aliens. 

I_± I Use your sector-editor and make 

the following changes: 

Irk Set Bytes From To 



S0B S0E $58-9A ? a// EAs 
$9B- 25 FC A9 FF 



Softkey for. . 



Alter Ego 

Activision 



[^J 



of Alter Ego 



Fast copy or COPYA all six sides 



dU 



Use your sector- editor and make 



the following changes: 

Trk Set Bytes From 

$13 $05 $64-A6 ? 

$A7- 25 FG 



To 



a/IEA's 
A9FF 



If the tracks and sectors don't match or you 
have another Activision program, try to search 
the disk for 38 2A 25 FC and if you don't get a 
match try just 25 FC. 

Then conies the fun part, first look for the 
last 60 (RTS) before the 25 FC, around 60 
bytes in the same sector. 

Next change all bytes between the 50 and 
the 25 to EAs. Then change the 25 to A9 and die 
FC to FF and write the changes back to the 
disk. 

The copy will now work fine and can be fast- 
copied. Good luck and Happy Kracking. 



J. Slate & Phillip Dohetty 



*IIgs Softkey for.. 



Bards Tale Ilgs 

Electronic Arts 



■ Retiuirements: 

n 3 '/2 " copy program (Copy fl Plus or other) 
D ProDOS sector-editor (We used ZAP on fi«^ 
of Tricks 11) 



\X 



[in 



J Copy Bards Tale Ilgs master, 
J Boot Bag of Tricks and select Z(4/'. 



Open file to edit; 



OPEN / BARDS.TAL^/ BURGER 

Li I Read block $00, 

Change byte $11 from B0 to 90. 
Change byte $26 from 38 to 18. 
Write these change.s back to the 



5 



copy. 
[ 



~ I Now you have an unprotected copy 

that can be put on a hard disk. 

An optional method for those who don't have 
a sector editor that will read 3 'A " drives, first 
makcacopy ofthcBardj Ta/e/Z^s master. Next 
copy die (We BURGER to a SW" disk. Then 
use any ProDOS sector-editor and search for 
the string 78 98 E9 IE B0, and change the B0 to 
90, Then look for the string E9 20 90 01 38 and 
change the 38 to IS, The second string should 
be around 20 bytes after the first string in the 
same block. Finally, write the changes back to 
the 5 W " disk and copy BURGER back to the 
3W drive. 



Jack Moravetz 



Softkey for... 



Mmesota Educational 

Computing Consortium 

mCQ software.,. 



■ Requirements: 

D Apple //-F, //e 
n Super lOB vl.5 
U Blank disk 

Usually using the Swap controller or a 
controller similar to Paul Giguere's one for 
Puzzles and Posters (COMPUTIST #46) will 
allow deprotection of MECC software. The 
protection scheme appears to be an altered 
address prolog from the standard D5 AA 96 to AA 
D5 AD and altered data prolog from D5 AA AD to 
D5 96 AA. The address and data epilogs 
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I decided to use the DOS from the original 
beeause it had data on tracks $0O, $©1, and 
$02. I changed my controller to copy from 
track $01 to S22 and used Diskmimcher 8.0 
to copy only track $00 to the copy since it was 
in standard format. Using the sector editor in 
Copy 11 Plus, I searched for D5 and examined 
the sector to see if the D5 was part of the 
address and data field that Oregon TraiVa DOS 
was looking for. 

Since the rest of the copy was now in 
standard format, track $0© needed some 
changes to make the copy boot. 

These are the sector-edits that the MECC 
controller will make: 



Trk Set Bytes 


Frotn 


To 


160 M6 S86 


95 


AA 


S8B 


AA 


AD 


J00 ?07 SIF 


96 


AA 


S2A 


AA 


AD 


$83 


AA 


D5 


S8D 


D5 


AA 


S98 


AD 


95 


100 $0A SA8 


AA 


05 


$AD 


D5 


AA 


$B2 


AD 


96 



1 came across many MECC programs with 
the same protection scheme, so I decided to 
include the sector-edits in the controller to save 
time and trouble. 

Here is a list of all the MECC programs 
that this controller has compietely 

de protected: 



Arithmetic Critters 



Counting Critters 



Ciocii Works 



First Letter Fun 



FuttFromAToZ 



Jenny's Journey 



MECC Dataquest: Fifty States 



Number Munciiers 



Paint With Words 



Path Tactics 



Phonics Prime Time 



Quiciifiash! 



Sliylab 



Sound Traciis 



Speedway Math 



Amazing Reading Machines 



the MariLct Piace 



WordMunchers 



Words At Worii 



If the address prolog on a protected MECC 
disk is AA D5 AD and the data prolog is D5 95 AA, 
there's a good chance that this controller will 
deprotect it. 

Controller 

1000 REM MECC CONTROLLER 

1010 TK = :LT= 1 :ST = 15 :LS = 15 :CD = yfR 

: FAST = 1 
1020 G0SU6 430 : GOSUB 490 : GOSUB 510 :T1 = 

TK :TK = PEEK (TRK) : GOSUB 310 :TK = T1 
1030 GOSUB 430 : GOSUB 490 : GOSUB 510 : IF 

PEEK (TRK) = LT THEN 1050 
1040 TK = PEEK (TRK ) :ST = PEEK (SCT } : GOTO 

1030 
1050 TK = 1 :LT = 35 :ST= 15 :LS = 15 :CD = yVR 

: FAST = 1 
1050 RESTORE : GOSUB 190 : GOSUB 210 : GOSUB 

430 : GOSUB 490 : GOSUB 610 
1070 GOSUB 230 ; GOSUB 430 : GOSUB 490 : GOSUB 

610 : IF PEEK (TRK) = LT THEN 1090 
1080 TK = PEEK (TRK ) :ST = PEEK (SCT ) : GOTO 

1060 
1090 HOME ; PRINT "COPV'DONE" : END 
5000 DATA 170 ,213 .173 ,213 ,150 :.170 
5010 DATA 10*CHANGES 
5020 DATA ,5 ,134 ,170 
5030 DATA ,5 .139 ,173 
5040 DATA ,7 .31 ,170 
5050 DATA ,7 ,42 ,173 
5060 DATA ,7 ,131 ,213 
5070 DATA ,7 ,141 ,170 



5080DATA0 ,7 ,152 .150 
5090DATA0 ,10 ,158 ,213 
5100DATA0 ,10 ,173 ,170 
5110DATA0 ,10 ,178 ,150 



Controller Checksums 



1000 


- $356B 


5010 


- $B321 


1010 


- $EA41 


5020 


- SCB92 


1020 


- IBBF5 


5030 


- S1250 


1030 


- J8863 


5040 


- S233B 


1040 


- $66DE 


5050 


- $69E8 


1050 


- S8D3B 


5050 


- IAE31 


1050 


- S3332 


5070 


- J0E7B 


1070 


- S80E2 


5080 


- J2145 


1080 


- S1954 


5090 


- $3032 


1090 


- $29D5 


5100 


- $DB95 


5000 


- $713C 


5110 


- SC573 



Softkey for.. 



Fish Scales 

DLM Software 



■ Requirements: 

n Apple II Plus, //e 

n Ability to reset into the monitor 

n Two blank disks 

U A DOS 3,3 slave disk 

D FID from DOS 3.3 System Klaster 

Fish Scales is an excellent early learning 
educational program dealing with numbers and 
measurement. Usually the Swap controller or 
the controller lor DLM software in 
COMPUTIST #25 by Gr^g Prior will allow the 
deprotcction, but they changed the address field 
epilogs and data field epilogs from the normal 
DE AA to 97 96. There was some data on track 
S2 also, 1 used Controller Writer from 
COMPUTIST #16 to write a controller for Fhh 
Scales. 

They added a nibble count routine to prevent 
copying the files and running the program. If 
you try to run your copy, it will only reboot. 
I found that the file FISH.OBJ& was the file 
thatdid the nibble count. Not being good at boot 
code tracing, I found a way to disable the nibble 
count by other means.. It may not be fancy, but 
it works. 



Step-by-step 

J INITialize one blank disk with a 



normal or fast DOS and put the disk aside for 
now. 

INIT HEUO 
DELETE HELLO 



Install the Fish Scales controller 
into Super lOB and run Super lOB to copy the 
original onto a blank disk, use the format disk 
option from within Super lOB. 
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I_5 I Using FID or file copier, copy all 

ihe files except FISH.OBJ0 from the copy 
made by Super lOB to the disk that was 
initialized in step 1 , We will capture 
FJSH.OBJ© later. 

I_5 I Boot the original Fish Scales disk 

and reset into the monitor after the title screen 
is displayed and the disk drive stops spinning. 



UTJ 



Insert your DOS 3 .3 slave disk and 
boot it from the monitor. 
C600G 



Save the file with the nibble count 
already performed to your slave disk or the disk 
that the other files were copied to. 
BSAVE riSH,0BJ(I,A$4000,L$0FFF 

If you saved the file to the slave disk, copy 
it with FJD or a file copier to the disk with the 
remaining files. That's all there is. 

Controller 



1060 REM F ISH SCALES CONTROLLER 

.1010 TK = :LT = 35 :CD = WR :Me = 151 : ONERR 

GOTO 550 
-mS ST = :TI = TK : GOSUB 490 : RESTORE : 

GOSUB 190 : GOSUB 210 : GOSUB 170 
;i.030 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST 

< 16 THEN 1030 
1040 IF BE THEN 1060 

10S0ST = :TK = TK- 1 : IFTK<LTTHEN1030 
1060 GOSUB 230 :TK = Tl :ST = : GOSUB 490 
1070 GOSUB 430 : GOSUB 100 : ST = ST + 1 : I F ST 

< 16 THEN 1070 

1080 ST = :TK = TK + 1 : IF BE = AND TK < LT 

THEN 1020 
1100 HOME ; PRINT "COPY'DONE" : END 
500@DATA213 ,170 J50 .212 .170 ,173 ,151 

.,150 ,151 .150 

Controller Checksums 



1000 


- I355B 


1060 


- S5DFB 


1010 


- S694C 


1070 


- i3FF0 


1020 


- JB431 


1080 


- S510A 


1030 


- SFF9D 


U00 


- J46C5 


1040 


- $137E 


5000 


- $5276 


1050 


- $E3BF 







Softkey for... 



Electric Crayon ABC's 

Polarwa re/ Penguin Software 



■ Requirements: 

D Apple II Plus, /.'e 

D ProDOS and BASIC.SYSTEM 

n COPyA OT disk copier 



Electric Crayon ABC's is a double hi-rcs 
computer coloring book which can be colored 
and erased. It also has the ability to print the 
picture and a calendar. 

Since it is primarily a program for children, 
I saw the immediate need to have a backup. I 
was disappointed to find that a ProDOS based 
program such as this was copy protected. 

After examining the system program, it 
appeared that the file SHAPES was nothing 
more than a protection file so I decided to 
disable it. 



Step-by-step 



Copy the origma 
COPYA or any disk copier 

[I 



I disk with 



] 



Boot the ProDOS Users disk and 



exit to BASICSYSTEM 

I ^ I Place the backup disk in the drive 

and type: 

PREFIX /A 

BLOAD SHAPES,A$9000 

CALL -151 

90(1(11:18 60 

3D0G 

BSAVE SHAPES,AS9(K10,LS00BD 

Electric Crayon is now in a COPYA-sble: 

format. 



Ron Balewski 



Ace-Apple 

Bi-modal Switching Puts 

Two Macliines in One 

I'm the proud owner of a Franklin Ace 
1000 series computer. I know it ain't an 
Apple, but 1 did save a BUNDLE of money by 
buying a machine that does almost everything 
an Apple does. Almost. 

My quest tor total compatibility came one 
step closer to reality recently when a friend and 

I found a set of Apple EPROMs at an area 
hamfest. Naturally, being true tinkcrcrs, we 
bought them. Of course they worked perfectly 
in our Franklins. Our ACEs even said APPLE 

II when turned on! 

But I missed certain aspects of the ACE 
1000 ROMs not supported by the Apple 
ROMs. I could keep swapping ROMs all the 
time to change from Ace to Apple, but that's 
too much work. I had to find an easier way. 

Fortunately, I didl Now I just flick a switch 
to either Apple or Aee before powering up the 
computer, and voila! The desired computer is 
at my disposal. And the procedure was so 
simple that, if you have an Ace and a friend 



with an Apple, you too can have a "bi-modar' 
Ace (Apple owners can even install a set of" Ace 
ROMs in their Apple's). Here's how the 
upgrade works. 

Some Franklin Ace's (see important note) 
and many Apple fl Plus' (1 think) use 2716 
EPROMs to store BASIC. 2716s hold 2K 8-bit 
bytes. You're going to substitute 2732s, which 
hold 4K bytes. You'll sUire Apple BASIC in 
the lower 2k and Ace BASIC in the upper 2K 
of each EPROM. 

Then, to select a BASIC, all you have to do 
is select either the top half or the bottom half 
of the new EPROMs. This is quite easy to do. 
The 2732 has one more address line than the 
2716. To select top or bottom, all you have to 
do is connect this highe.st-bit address line to 
either -FSv (logical I) or ground (logical 0). 
That's ill 

Here's what you'll need to do the job: 

■ Required Components: 

n Components: 

D 6 24-pin IC sockets (Radio Shack #276-1989) 

n 6 2732 EPROMs 

U 1 SPOT Switch (such as Radio Shack 

#275-613) 
n 1 4.7k resistor (Radio Shack ^271-030) 
D Wire 

■ Required Too Is/ Accessories: 

n Apple II or Franklin Ace 1000 
n EPROM programming card 
n EPROM eraser (maybe) 
LJ Soldering iron 

L.Misc. hand totol<t_ 

Now For the procedure. The hardest part will 
be burning the new EPROMs. You must first 
assemble a disk containing both Apple and Ace 
ROM images, 

Ixt's start with your Ace, Put a formatted 
disk into your disk drive and type the following: 

BSAVE ACE D0,A$D000,L$800 
BSAVE ACE D8,ASD8(9Q,L$800 
BSAVE ACE E0,A$E(II(1I(!I,L$800 
BSAVE ACE ES,ASES0CI,L$800 
BSAVE ACE FO.ASrOOO.LSSDO 
BSAVE ACE F8,ASF800,LS8(9Q 

Now take your di.sk to your Apple-owning 
friend's hou.se, put it in his disk drive and type 
the sis statements above, except substitute 
APPLE for ACE in the file names. 

You now have all the files you need to burn 
your new ROM.s. Plug in yonr EPROM burner 
and let's go. 

First, load in the "D0" ROM images by 
typing: 

BLOAO APPLE DO,A$10eO 
BLOAO ACE D0,A$1800 

The data for your first EPROM is now loaded 
into memory from S1OO0 to SlFFF. 
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Note that Apple is on the bottom and Ace is 
on top. To write the EPROM, just plug a 2732 
into your EPROM burner and write ffldXDO 
thru $1FFF to it. 

Burning the other five EPROMs is very 
similar. Just repeat the above steps, changing 
each "DO" in the above BLOAD statements 
to "DS", then "EO". then "ES^'ahen^FO", 
and finally "F8", 

Malcc sure you mark each EPROM as you 
program thcml They must be installed in the 
proper order! 

Next, you've got to install the new EPROMs 
In your Ace. Here'.s the procedure. 

Step-by-step 



i I Remove the cover from your Ace 

and remove the 6 EPROMs. You should find 
a box drawn around them and labeled 
■■EPROM AREA". 



[HJ 



Insert your nevv 2732 EPROMs into 



24-pin sockets. 



SH 



Bend pin #21 of each IC socket 
outward at a right angle. To find this pin, look 
at the EPROM/socket combination from the 
top. Position the EPROM so that the notched 
edge faces downward. Pin #21 Is the fourth one 
from the bottom oii the left-hand side. 



I ^ I Plug the EPROM/socket assemblies 
into the sockets on the Ace. If you sit facing 
the Ace, the notched edge of the EPROM 
should be toward you and the bcnt-out pin 
should point left. The EPROMs should be 
Inserted in the following order from left to right: 
F8. FO, E8, E0, D8, DO. The circuit board 
is labeled, in ease you get confused. Just make 
sure you plug the proper chips Into the proper 
sockets! 



bent pins to connect Ihem all together. 



Carefully solder jumper wires to the 



Mount a SPDT switch to your Ace, 



Connect a wire from the common 
terminal of the switch (usually the center 
terminal) to any of the bent pins (since they're 
all connected together, they'll all get the same 
signal regardless of which pin the switch wire 
is connected to). 



8 



Connect either of the other two 
terminals on the switch to a ground point on 
the Ace circuit board. I used the lead of part 
CG3 that faces the keyboard (CG3 Is on the far 
right of the circuit board near the big letter G) . 

I ^ I Connect the final switch terminal to 

+ 5v through a 4.7k ohm resistor. For +5v, 
I used the opposite lead of CG3, as described 
above. 



That's it! Now turn on the Ace and see what 
happens! You'll get cither the Apple or the 
Franklin power-on message. 

Try turning off the computer, flipping your 
new personality .switch, and turning on the 
computer again. You should now get the other 
power -on message. 

You now have the best of both worlds. When 
you want your Ace to be an Ace, It can. But 
when you need super-compatibility , just flick 
the switch and Ace turns Apple! 



Important Note 

Franklin Ace lOOO series computers 
wliich have disk controllers built untu the 
mother Iroard do NOT use six 2716s. Instead, 
they u.sc three 2732s to save space. 

You CANNOT use this trick on these Aces. 

The 2764s that you'd need have more pins 
than the 2716s and 2732s. Therefore, they 
wouldn't fit properly in the sockets. 



[A 



Make the following patches to the 



Softkey for,. 



Super Boulder Dash 

Electronic Arts 



Super Boulder Dash from Electronic Arts 
(EA) is an excellent arcade-type game that I'd 
recommend to anytme ~ especially since it's 
considered a 'classic' and can be had for less 
than $1O,0O! 

Of course, like most games. It's copy- 
protected. I usually just back up protected 
software with EDD 4 P/us. but EA software 
always presents problems. Oh, well, I'll just 
have to deprotect it! 

At first I thought I could be lazy and find the 
deprotect spell in COMPUTIST. But my hopes 
faded when I saw Super Boulder Dash on the 
Most Wanted list. I guess I'm on my own for 
this one! 

Fortunately, Boulder Dash seems to use 
Electronic Arts' standard copy -protection. 
Deprotecting It was really quite easy, 1 used 
exactly the same method as outlined for Marble 
Madness in COMPUTIST #47. The only 
difference Is that with Super Boulder Dash, both 
sides must be deprotected. I suppose they 
protected both sides since each side contains a 
different game. 

To deprotect Super Boulder Dash, just do the 
following to both sides: 



I * I Copy the disk using any copy 
program that can Ignore errors or skip tracks 
(you must skip track $06). 1 used 
COMPUTIST 's Super lOB with a slightly 
modified Standard controller. 



disk with your favorite sector-editor: 



Trk 

$01 
$01 



Set 


Bytes 

$00 

$00-02 

$5F-71 


From 


J0C 
$0F 


4C 

4C 69 A0 

AC 69 A0 



To 



60 

18 50DD 

18 50 DO 



That's it! .^uper Boulder Dash is now 
deprotected 1 

(2) Let me warn you that there may be a 
problem with the game on the back side of the 
disk (Boulder Dash IF). On my deprotected 
copy, certain levels don't work. The screen just 
fills with garbage and the computer hangs up. 
However, the first side has been working fine. 
I suspect that I just copied a track wrong 
somewhere on my disk and haven't tracked it 
down yet, 

I'd appreciate hearing from others who 
deprotect Super Boulder Daxh. I'm really 
curious whether the side 2 problem is indeed 
a bad copy or whether EA did something really 
strange on that disk! 



A. L. Head 



Softkey for... 



Word Handler 

Advanced Logic systems 



List Handler 

Advanced Logic Systems 



■ Requirements 

D Word Handler 

n List Handler 

U COPYA or other standard copier 

C Sector-editor with search capability 

D Nibble-editor 

The Handler package consists of: 
Word Handler 
List Handler 
List Utilities 
Spell Handler. 
The Word Handler occupies two sides of a 
disk. Side A Is for those without an 80-column 
card, and Side B is for those with one. 

Li.'it Handler and List Utilities are designed 
to accommodate all kinds of lists and to 
manipulate the lists. 

Spell Handler is a 90,000-word dictionary 
used to check a document for misspelled words. 
These programs operate together as an 
integrated package. 
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The Protection 

The Word Handler and List Handler are 
protected software. Lis! Uti lines and Spell 
Handler are unprotected and can he copied 
using standard copiers such as COPYA. 

The iVord Handler and Lixt Handler are 
written in a nearly standard DOS 3.3 Ibrmat 
and can be cataloged from a DOS 3.3 
environment. In addition, both can be copied 
without error using COPYA m Lixksmith 6.0 
Fast Disk Backup. However, both will hang 
during the booting proces.s. 

A catalog of The Word Handler shows 
thirteen files with the boot-up file being an 
Applesoft t~de named WRDHND. The List 
Handler has two files with the boot-up Tile being 
an Applesoft file named HELLO. 

An examination of the disks using a nibble 
editor, such as contained in Lockxinith 6.0 ot 
Copy II Plus, shows that the sync nibbles used 
are AA's instead of the usual FF's. This of itself 
is of little signifieanee unless it is used in the 
protection scheme. In the large sync field 
preceding physical sector SO© of each track a 
string of nibbles has been inserted as follows: 

DiskNibbles: M AA AD AA B3 F=E A£ FE AE FE 
FramirtgBits: 220C000000 

Drsk Nibbles: AE FE AE AC AC AC AA AA AA AA 
FramingBits:. 0000002222 

Locksmith 's Framing Bit Analyzer was used 
to determine the number of framing bits. 

The Word Handler 

The next task is to determine what is 
happening during the booting process. As 
mentioned earlier, the boot-up file is an 
Applesoft file named WRDHND. Examination 
of this file shows that it provides the first menu 
where selections are made. 

The number 1 selection is "RUN WORD 
HANDLER," If this selection is made, a text 
file named WRD is executed. Examination of 
WRD shows that it BLOAD's WI, WA, and 
WB in that order and then BRUN^s WH. 

An interesting characteristic of using text tiles 
to control machine operations is that the BASIC 
cursor is generated for each line executed. This 
means that four cursors will be seen on the 
screen when WH begins to run. This clue 
signals when execution of the code begins. 
When the copy is booted the four cursors are 
seen as predicted and then the copy hangs. 

My Trak Star shows that the read/write head 
is positioned over track S17. A nommaskable 
interrupt (NMI) at this point using the Senior 
PROM shows the Program Counter pointing to 
address $,i572: the first return on the stack is 
$4702. 

Remember that one (1) must be added to this 
to get the return address. Jumping into the 
monitor and disassembling the code on pages 



$46, $47, $55, and $56 reveals the protection. 

Beginning at S46FD (file WK), the 
disassembly shows a jump to the subroutine at 
$5500 (file WB). The return address, S4703, 
executes a branch to $473B if the overflow flag 
is cleared. If the overflow flag is set the 
execution falls through to an endless loop at 
S4705 through $4708. Obviously, the overflow 
flag must be cleared on return from the 
subroutine to continue program execution at 
$473B. 

This code can be seen by BLOADing WH 
from a DOS 3.3 environment and disassembling 
it beginning at S46FD. 

A disassembly listing of the interrupted 
program code beginning at $5,5O0 reveals the 
heart of the protection being used . This is self- 
modifying code. The raw code can be seen by 
BLOADing WB and disassembling it beginning 
at $550©. This code is alright down through 
$5,525. The modified code can be seen only 
after the execution of the file. 

Notice that S550A through $5518 modifies 
memory from $5526 through $5625 by EORing 
$AC with the corresponding memory contents 
from the unmodified code. 

This code is further modified through the 
jump at S5526 to $567L Memory locations 
$5529 through $5627 are EORed with SB5. 

Finally, the code is modified again through 
the jump at $5686, The modified code seeks 
the hexadecimal string AA AD AA B3 beginning at 
$5572. This looks familiar. Then, it reads the 
next 507 nibbles and stores them at $565F 
through S5659. It runs a comparison and then 
seeks four consecutive sync AA's. Finally, the 
execution returns to the caller ($4703) at 
S5657, All of the code on pages $5,") and .$56 
is self-contained and deals with the protection 
scheme. When the return occurs the overfiow 
fiag is either cleared or set. 

Anyone can see the codes referenced above 
by pressing IBRESET I at least twice in rapid 
fashion immediately after the fourth BASIC 
cursor appears. This is coincident with the 
hang. This will place the machine in BASIC. 
Type the following; 

CALL -151 

B7EC truck number being mxcssed 
46DFL disassembly listing, .w note. 
SSOOL disassembly listittg. see note. 

Note; Press an additional "L" for another 
screen of listings. 

If the second disassembly listing does not 
agree with the discussion, interrupt the program 
at a slightly later time. Execution must be in 
the vicinity of S5572 for the deciphered code 
to be present. 

In summary, this protection scheme is 
contained in a file named WB. It involves self- 
modifying code that does read the signature in 
the syne field before the address of sector S0O 
of track $17, It also cheeks the sync nibble 



before the signature and the four (4) sync 
nibbles after the signature to see if they are 
$AA's, If all the protection hurdles are cleared, 
the execution returns to $4703 with the 
overfiow fiag cleared. 

List Handler 

The List Handler has two files. The HELLO 
file simply BRUN's MAINS. There is also a 
deleted file named MAIN2 on the disk. Booting 
a copy of List Handler and NMIing it just as 
it hangs shows the read/write head over track 
SIE, the Program Counter pointing to $3172, 
and the first return on the stack at S3008. The 
return address wdl be $3009. Examining this 
code shows it to be identical to that for Word 
Handler loaded at different memory locations. 
The address of $3000 corresponds to $46FD 
for The Word Handler. The address of S3100 
corresponds to $5500, If the overflow flag is 
cleared on return the program execution falls 
through to $3800. 

Again, disassembly listing can be obtained 
for this program by using the [BRESET 1 
approach discussed previously. The BASIC 
cursors are not available to provide the reset 
signal. It must be done, however, just as the 
program execution hangs. 

The protection scheme is identical to that 
used for The Word Handler. 

The Deprotection 

Standard copiers will be defeated because 
they will ignore the inserted nibbles. The tracks 
will be formatted with the usual sync nibbles 
of FF with no nibbles inserted in the sync field. 

The popular bit copiers wiU do a reasonable 
job of copying the altered sync field. Both 
Locksmith 6. and Essential Data Duplicator 
III will successfully backup the Handlers most 
of the time using default settings. Copy IFPlus 
will tail. All will work if the proper parameters 
are set to find the track start/length realistically, 
reproduce the inserted nibbles, and write the 
syne nibble as AA. Ofcour.se, the goal here is 
to remove the protection. 

The best way to deproteet The Wexrd Handler 
and List Handler is to go to the beginning of 
die protectitin ctxle, clear the overflow flag, and 
return to caller. The calling code could be 
modified to prevent the jump to the subroutine 
containing the protection code, but on some 
future version the jump might be placed 
somewhere else. Here is the way to do it. 

Using a sector editor with search capability ^ 
such as Locksmith INSPECTOR/WA TSON or 
the Senior PROM Sector Editor, search each 
copy of The Word Handier and List Handler 
for the hexadecimal string 086S8D51. On my 
program disks this string is located at track $16, 
sector $0E, byte $04 for 'Ike Word Handler 
and on track $19, sector $0D, byte $<M for Usi 
Handler. 
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Make the following sector edits and write 
them hack to disk; 

The Word Handler (both sides) 

Trk Set Bytes From To 

■J1&. ME m 0s ea 



B8 60 



lAst Handler 

Trk Set Bytes From 
$19 $BD %U 08 68 



To 



B8 60 



The problem with track/sector edits 

This dcprotects the c;opies. They are already 
COPYA-Msi. However, the trouble with 
track /sector edits for file based programs is the 
ease with which the files can be relocated on 
the disk, thereby changing the track /sector 
location for the edit. Sometimes all the 
producer of the protected software does on 
later versions is relocate the files on the disk. 

It is better to load the protection files, edit 
them in memory, and then save them back to 
disk. This approach frees the softkey from a 
particular track/sector edit. 1 have written a 
Controller for Super lOB 1.5 to copy the disks 
and perform the file edits. It is presented at the 
end of this article. A few comments are 
appropriate. 

Lines 1000 through 1040 are the Fast 
Controller that copies the disks. Lines 
1050—1080 set the ONERR fiag, identify 
which Handler is being copied, and load the 
appropriate file into memory. Lines 1085 and 
1090 detemiine the load address and the length 
of the file loaded. Lines 1095 and 1 1O0 verify 
the code to be edited. If the verification fails, 
instruction.s are given in lines 1 105—1 120, If 
the verification is successful, the edits are made 
in either line 1125 or 1130, The file is then 
unlocked, the edited file saved, and then locked 
again in lines 1135 — 1145, Finally, a closing 
jnessage is printed on the screen in lines 1220 
and 1225, If neither file can be found on the 
disk, and abort message with bell clanging i.s 
given in lines 1230 and 1235, The error 
handling routine begins at line 1200 with a call 
to a subroutine that repairs the stack. Then, Lim 
Handler is identified by a deliberately caused 
error. If the error is other than error number 
6 (FILE NOT FOUND), the error that has 
occurred is idenfified in line 1205 along with 
the litie number involved. 

Discussion 

The protection used on the Handlers is typical 
of add-on schemes. The protection is 
implemented through some protection file 
during boot- up. Then, if the protection hurdles 
are all cleared, the unprotected program code 
is executed. Usually, the reset pointers have 
been changed to point to some re-boot or some 
memory wipe routine. This type of protection 



can be defeated by eliminating the protection 
code and going directly to the program code to 
begin execution. This is what 1 have done in 
this softkey. 

On the brighter side, the protectors sometime 
make things easy. Always examine everything 
on a disk, including the deleted files. About 
three years ago, I spent hours on the program 
SIDEWAYS only to discover a complete 
deseripfion of the protection in a deleted file. 
Ust Handier has a deleted file named MAIN2 
that has not been overwritten. It loads at 
S380O. This is the address that /W/lWijumps 
to after all the protection checks have been 
safisfied. If MAIN2 is undeleted and then 
BRUN; presto, the List program comes right 
up, A tile can be undeleted by using a sector 
editor or by using a utility with an undelete 
option, Boxh Locksmith 6.0 -dud Copy II Phis 
have undelete options. Undelete MAIN2 and 
change the HELLO program to BRUN MAIN2, 
and you will have a deprotected List Handier 
the easy way . The other procedure is 
recommended because this one may not last 
long. 

Controller 

1000 REM HANDLERS CONTROLLER 

1010 TK = :LT = 35 :ST= 15 :LS= 15 :CD = WR 

: FAST = 1 
1020 GOSUB 490 : GOSUE 610 
1030 GOSUB 490 : GOSUE 610 : IF PEEK (TRK) = 

LTTHEN 1050 
1040 TK = PEEK (TRK ) :ST = PEEK (SCT ) : GOTO 

1020 
1050 HOME :DJ = CHRS (4 ) :QJ = CHR$ (34 I 
1055 ONERR GOTO 1200 
1060Z = :F$ = "WB" 
1065 Z = Z + 1 : PRINT : PRINT D$ "VERIFY" :F$; 

'■,D" ;D2 
1070 IFZ = 1THENNJ 
1075 IFZ = 2THEfJNS 
1080 PRINT DI "BLOAO 
1085 BA = PEEK (43634 ) 
1090 LA = PEEK (43616 ) 



1145 PRINT D$ 
1200 CALL 822 



LOCK" ;F$ : GOTO 1220 
IF PEEK (222) = 5 THEN 1210 



256 

256 
104 



"TORD'HANDLER" 
"LIST'HANDLER" 
;FI 
■ PEEK (43635 ) * 
■PEEK (43617) * 
1095 IF PEEK (BA ) = 8 AND PEEK (BA + 1 ) = 

AND PEEK (BA + 2 ) = 141 AND PEEK (BA + 3 ) 
= 97 THEN 1125 
1100 IF PEEK (BA + 256 ) = 8 AND PEEK (BA + 257 
) = 104 AND PEEK {BA + 258) = 141 AND 
PEEK (BA + 259 ) =97 THEN 1130 
1105 PRINT "ED I r FA I LED. ^SEARCH"" :N$; '"FOR" 
1110 PRINT "THE'HEX'STRING'" ;QS: 

"08'68'8D^61" ;Q$; "'AND'CHANGE" 
1115 PRINT "TO"' ;QS: "B8'60" :QI: 
"'BEGINNING'AT'" ;QJ: "03" ;Q5: 
".'WRITE" 
1120 PRINT "SECTOR' BACK' TO' THE' DUPLICATE* 

DISK." ; END 
1125 POKE BA ,184 : POKE BA + 1 .96 : GOTO 1135 
1130 POKE BA + 256 ,184 : POKE BA + 257 ,96 
1135 PRINT D$ "UNLOCK" :F$ 
1140 PRINT DI "BSAVE" ;FS; ",A" :BA; ",L" LA 



"■ ; PEEK (222 ); 
(218)-PEEK(219) 



■■" ir 

* 256 



■NOW 



1205 PRINT "ERROR* NO 

LINE'NO '" ; PEEK 

: END 
1210 IFZ> ITHEN 1230 
1215 F$= "MAIN3" . GOTO 1065 
1220 HOME . VTAB 4 : HTAB 5 : PRINT NJ 

DEPROTECTED" 
1225 VTAB 6 : HTAB 12 : INVERSE : PRINT "THAT'S' 

ALL' FOLKS" : NORMAL : VTAB 24 : END 
1230 FOR I =1T03 : CALL- 1052 : PRINTSPC{6); 

"ABORT" : : NEXT 
1235 PRINT : PRINT : HTAB 5 : PRINT "SOMETHING' 

IS' WRONG.' CHECK' DISKS I" : END 

Controller Cliecksums 



1000 


- $3566 


1110 


- I7E4B 


1010 


- J2544 


1115 


- SCF49 


1020 


- $08CD 


1120 


- SE43B 


1030 


- J0B00 


1125 


- S399A 


1040 


- IA1C7 


1130 


- SF06B 


1050 


- $Ee03 


1135 


- SBAE3 


1055 


- I1B38 


1140 


- ?B201 


1050 


- IA05D 


U45 


- SFEBE 


1065 


- I4EEB 


1200 


- $FB52 


1070 


- ISDCC 


1205 


- $749F 


1075 


- $7096 


1210 


- J69B8 


1080 


- J0129 


1215 


- I832B 


1085 


- $E3D7 


1220 


- $77D0 


1090 


- JE3F0 


1225 


- $AC03 


1095 


- $E05F 


1230 


- i50DC 


1100 


- tasiA 


1335 


- JD6CA 


1105 


- JF4FE 







Softkey for. . 



PFS software -Vram^ 

Software Publishing Corporation 



pfs: Write 



pfs: File 



pfs: Graph 



pfs: Report 



pfs: Plan 



■ Requirements 

C Apple lie or He, 128K 

D One disk drive 

n COPYA or Locksmith Fast Disk Backup 

U Sector Editor with search capability 
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The ProDOS versions of the PFS Software 
shown in [he title are much improved over the 
Qlder DOS 3.3 versions. The individual 
packages can function independently of each 
other or as an integrated system. 

The FFS.Diaioiwry is a 7 5, 000 -word 
dictionary that is used to checit for any 
misspelled words in a document. It is on an 
unprotected disi<. 

Also, supplied is a PFS:Convert program that 
is used to convert previous non-ProDOS PFS 
data files to ProDOS PFS data files. This 
program is also on an unprotected disk. 

The Protection 

I usually start the protection analysis by 
attempting to copy the software with Locksmith 
6.0 Fast Disk Backup. I use this program 
because it is a good diagnostic tool, and it takes 
only 25 seconds to copy and verify a disk. It 
will continue to copy if if encounters non- 
standard formatting and will indicate the nature 
of the discrepancy, such as A for address field 
error or D lor data field error. This is shown 
by the track and sector so that one knows 
immediately where to start looking for the 
modifications. A hard copy of this di.splay can 
be obtained if desired. In addition, any sector 
that has an error will be left in a standard 
formatted condition on the copy. 

All of the PFS software will copy with no 
indication of error. This shows immediately that 
no formatting modifications have been used. 
However, the copies thus produced will not 
complete the boot. Each hangs just after 
ProDOS is loaded and the display switches to 
80-columns. 

A word about how ProDOS bix:)t.s is in order. 
ProDOS is loaded first It then loads the first 
system file it can find into memory at $2000 
and passes control to this file. If this is 
BASIC.SYSTEM, this system file then runs a 
BASIC file called STARTUP to load the 
balance of the program. In our case the first 
system file is .something like 
WRTTE. SYSTEM, for instance, for PFS: 
Wnte. tn the ProDOS environment this first 
system file nearly always contains the protection 
code. This is indicated here, because the hang 
occurs almost immediately after ProDOS is 
loaded. 

Jf there are no format modifications, the 
protection code must be looking for a .signature 
that i.s dilllcult to reproduce or it must be doing 
a nibble count somewhere. I have my machine 
equipped with the Senior PROM and with Trak 
Star. Senior PROM provides an NMI 
(nonmaskable interrupt) capability with all the 
needed subroutines in the PROM. The Trak 
Star show.s what track drive I is accessing at 
any given instant These toola make the task of 
determining the protection much easier. If a 
copy of any of the PFS software made with 
COPVA, Fast Disk Backup, or any other 



standard whole disk copier is booted and 
NMI'ed just before it hang.s; the Ttak Star 
indicates track $0© and the Program Counter 
from Senior PROM shows an address of $F91 
to $F94 depending on the time of the NMI, The 
stack shows the first return to be to $E45. 
Entering the monitor from Senior PROM and 
disassembling the code around these locations 
shows the following: 

• I At $E42 there is a jump to the subroutine 
at SF63. At SE45 the content of the accumulator 
is compared with SO0, If the accumulator is 
not equal to $00, a failure path is taken. If it 
equals SO0. program execution jumps to 
$I07D, the entry point to the program. 

• 2 The subroutine at $F63 is the protection 
code. It sets up the read block routine and then 
looks for a signature. It plays some bit-games 
with what it finds and then returns to the caller 
with either $00 or $FF in the accumulator. The 
return is at $FDO. From what was revealed at 
$E45, the value of $00 is the good number to 
have in the accumulator. This entire protection 
code can be avoided by going to $F63 and 
entering the code to load the accumulator with 
$O0 and then return to the caller; namely, A9 
00 60. 

As a matter of interest the signature that is 
sought by the protection code is contained in 
the sync field that precedes physical sector $01 
on track $00. This corresponds to DOS 3.3 
sector $07 or ProDOS block $©4. Use a nibble 
editor to see this signature. 

The sector interleaving is defined in the 
books Beneath Apple DOS and Beneath Apple 
ProDOS published by Quality Software. The 
nibbles are: 

DiskNibbles: FB FF FF FF 
FramingBits: 2 2 

The number of framing bits in each byte was 
determined using Locksmitfi 6.0 Framing Bit 
Analyzer. The framing bit.s are used by the 
dep rote ct ion code. 

For those that are interested in examining the 
code discussed above, boot the copy and let it 
hang. Then, press ISRESET l at least twice in 
rapid succession until the BASIC prompt 
appears. Enter the monitor (CALL -151) and 
disassemble the protection code (F63LLL), Then 
disassemble the code that calls the protection 
(E42LL). 



The Deprotation 

I I Copy the PFS software using any 

standard whole disk copier such as COPYA or 
Fast Disk Backup. 



Trk Set Bytes From 



$04 S0F SF5 



A0 01 A2 



To. 

A9 00 60 






Write the change back to disk. 



the above fails, search the entire 



disk for the string: A0 01 A2 05 BD. 



H 



A2 to A9 f 



At each occurrence, change A0 01 
60 and write the sector back to disk: 



You now have a CCfPK/lable backup of the 
PFS software. 

Remarks 

The type of protection employed on PFS 
software is referred to as the bit insertion 
method. It is a mild form of protection thai 
defeats standard copiers; however, most bit- 
copiers can prtxluce a protected backup. 

This is the same type of protection used on 
the earlier DOS 3.3 versions. See Deprotecting 
PFS Software by Garv' Wolfe in COMPUTIST 
#14. 

Locksmith 6.0 can be used to automate the 
so ft key pnjvidcd herein using the Locksmith 
Programming Language. Last but not least, a 
Super lOB Controller can be written to copy 
the software and make the edits. Such a 
controller is provided at the end of this article 
for those that have Super JOB 1 .S. 

As mentioned earlier PFS: Dictionary and 
PFS.Convert arc unprotected programs. 

Controller 

J80A$ = "VOLUME'NUM6ER'FORXOPY*=>r' : HOME 

; GOSUB450 : HTAB 33 : INPUT "" ;VLJ :VL 

= VAL (VLS) : I F VLJ = "" THEN VL = 1 
1000 REM PFS PRODOS SOFTIVARE 
1005 REM CONTROLLER 
1010 TK = :LT = 35 :ST = 15 :LS= 15 :CD = WR 

: FAST = 1 
1020 GOSUB 490 : RESTORE : GOSUB 510 :T1 = TK 

:TK = Tl + 5 : GOSUB 310 :TK = T1 
1030 GOSUB 490 : GOSUB 610 : iF PEEK (TRK ) = 

LT THEN 1050 
1040 TK = PEEK (TRK) :ST = PEEK (SCT ) : GOTO 

1020 
1050 HOME :AS = 'THAT'S'ALL^FOLKS" : GOSUB- 

450 : END 
2000 DATA 3'CHANGES 
■20ieDATA4 ,15 ,245 ,169 .4 .15 ,246 .0 .4 

,15 ,247 ,96 

Controller Checksums 



L? I Make the following edit (DOS 3,3 

interleaving) using your favorite sector editor: 



380 - ?4C54 

1000 - JSICA 

1005 - $EA67 

1010 - S8777 

1020 - $7CeB 



1030 - $65C8 

1040 - JB961 

1050 - $9F46 

2000 - $FFEB 

2010 - S6A2B 
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t Softkey Addendum for... 



Zardax vSJ.l 

Computer Solutions 



■ Requirements: 

I ~ Zardax Program Disk 

\~ Zardax Utilities Disk 

n COPYA , Advanced COPYA , or Locksmith 

6.0 
D COMPUTIST «1 
D 2 Blank Disks 

Zardax is a word processor based on a 
modified DOS 3.3 operating system. It is 
designed to operate on machines with as little 
as 48K of memory. It is a good word processor 
for its time (early 1980's). However, it does 
not measure up to the latest crop of word 
processors that take advantage of added 
memory and ProDOS, It needs to be updated 
to compete. 

a note on W. Hinger's... 



Deprotecting Zardax 

COMPUTIST #3L Page 24 

In COMPUTIST #31 William Hinger 
published a masterful, scholarly softkey for 
Zardax. The only problem is that the application 
of this softkey to version 5,2. 1 docs not produce 
a backup that can be re-configured with the 
Utilities disk. 

The protection used is implemented through 
a combination of BASIC and machine language 
programs, and the disk formatting is modified. 
The heavy protection is included in the file 
HELLO 1 . I never did liberate this Applesoft 
BASIC program. However, I was able to trace 
the file from its track/sector list, read the 
consecutive sectors with INSPECTOR/ 
WATSON, use the ASCII display, and view 
what was happening. 

Fortunately, Mr. Hinger wrote a machine 
language program called BOOTCODE to 
function as the second boot stage that loads 
ZARDAX, obviating the need for HELLOL 

On die original, modified data marks are used 
on track $03 sectors SOF. $0E, SflD, $DC and 
SOB. Tracks $05 - $10 are written in a non- 
standard format. An address header of D5 AA AB 
is used. Most of this is explained in the cited 
article. In fact, the protection used on version 
5.2.1 is identical to that described in the 
previous article. 

Except for a minor change to step 4, Mr. 
Hinger' s softkey can be followed down to step 
17 under the "Here's How" section. 

The modification to COPYA given in step 
4 needs to be changed to prevent the string 
variable, 1$, from getting scrambled and to 
allow track $23 to be formatted. 



Add the following BASIC lines to COPYA 
instead of those given in Mr Hinger's step 4, 

171 INPUT "STARTING^RACK:^" :ST : INPUT 

"ENDING'TRflCK:"" :LT : IF (ST > 35 ) OR 
(LT>35 ) OR (ST> LT ) THEM 170 

172 POKE 770 ,LT+ 1 : POKE 863 , LT + 1 : IF ST 

> THEN POKE 721 , ST - 1 : POKE 122 . ST - 1 

173 PRINT : PRINT : I NPUT "FORMAT' ?HIS* 

DISK?'" ;A$ ; IF LEN (A$ ) > AND LEFTS 
(AJ ,1 ) = "Y" THEN 175 

174 FT = 1 

177 POKE - 16542 , 36 : REM FORMAT TRACK 
35(S23) 

I suggest that FASTCOPY from Lockstnith 
6,0 be used to copy the disk instead of COPYA . 
The tracks that are not of standard format will 
not be copied, but they will be left in a standard 
formatted condition. 

In step 17 of the "Here's How" (step 18 of 
the step-by -step) Mr, Hinger modified the 
binary fWe^ LOWER. WRITER written on the 
program disk. This file is still on the program 
disk, but it is no longer used by the SETUP 
program on the Utilities disk. Examination of 
the SETUP file on the Utilities disk shows that 
it loads. NLWRITER from the Utilities disk. It 
is a file very similar to LOWER. WRITER, and 
it is used for the same purpose. This can be seen 
in lines \&(D and 942 of the SETUP program. 

Also, in NLWRITER the data header marks 
are first modified to read/write protcctdi sectors 
and are then restored to their normal values. 
This file will have to be changed to permit the 
5£7't//' program to work with the unprotected 
backup of Zardax. 

1 ^^ I Insert a backup of the Utilities disk 

and modify it as follows: (This disk is 
unprotected,) 

BLOAD NLWRITER,AS4700 

CALL -151 

4703:02 02 07 5F 48 

4771:38 E9 

4780:38 E9 

4788:BO 

To prevent data headers from being changed, 

47BA:AA 

3D0G 

UNLOCK NLWRITER 

BSAVE NLWRITER,A$4700,LSF6 

LOCK NLWRITER 

The backup will now boot in about half the 
time of the original. As noted in the previous 
softkey, there are numerous files on the 
program disk that are not needed for the 
unprotected backup. Both backups of the 
program and Utilities disks can be copied whh 
any standard whole disk copier such as COPYA 
or Locksmith Fast Disk Backup. 

To re-configure the backup program disk, 
boot t he backup U tilities Disk, At the menu 
press IBRESET < o enter BASIC. Insert the 



backup program disk, put the backup Utilities 
disk in drive 2, and RUN SETUP from drive 1 , 
Follow the prompts to complete the setup. 
There is also a SETUP file on the program disk 
that simply executes SETUP on the Utilities 
Disk. The file SETUP on the Utilities Disk 
could be RUN directly, but much disk swapping 
would ensue. It is better to do as noted above. 
This completes my addendum to Mr, 
Hinger's excellent softkey, 

Softkey for. . . 



Silent Service 

MicroProse 



■ Requirements: 

C 64K Apple II with joystick 
L NMI capability 
\Z Sector-editor 
C Silent Service 

Silent Service is an excellent submarine 
warfare simulation program. The setting is 
'World War II (WWII), All of the scenarios are 
built around actual WWII submarine missions, 
A person must learn rudimentary submarine 
tactics and must make decisions quickly. As 
skills improve a higher difficulty level can be 
selected and more difficult missions attempted. 
Ones performance can be measured against the 
performance achieved on the actual mission. 
This is a very intere.sting program. 

The disk ha^ a very sophisticated protection 
scheme that defeats most attempts to make a 
backup. A registered owner can obtain a backup 
from the manufacturer for a fee. 

The Known Protection 

An examination of the program disk shows 
it to be of standard format for tracks $0© 
through $21 , This can be determined easily by 
attempting to copy it with Locksmith 6. FAST 
BACKUP. Track $22 produces address field 
errors. 

A more detailed study of tracks $21.25, 
S21,5, $21,75, S22, $22.25, and $22.5 reveals 
that every track from S2I to $22.5 is identical 
to track $21. In other words, all of these tracks 
were written simultaneously with a wide head. 
It is obvious that the protection is associated 
with these identical tracks. 

Using the Nibble-editor in Locksmith 6.0 
shows that the tracks under discussion are 
empty of data for the most part. Sector $00 
has one data byte near the end of the sector. 
The next step is to determine how the program 
is accessing these tracks. 

Silent Service can be cataloged from a normal 
DOS 3.3 environment. The bootup program is 
a binary file named \\ that loads at $02O0 
with a length of $EE bytes 
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At this point I decided to study the booting 
process. I have a Trak Star that displays the 
tracks that drive 1 seeks. In the early boot stage 
the read head seeks tracks $21.3 and $22. If 
it does not find what it wants the program hang.s 
with a "HARDWARE FAILURE" me.ssage. 

Code in volatile memory 

The next step is to study the bootup program, 
'\\, Since this file loads at $200, a slight 
problem is presented. The first few bytes 
beginning at $200 are volatile memory. This 
area is used as the keyboard buffer. This can 
be remedied by loading \\ at S2200. 



I_l I Boot a normal DOS 3.3 disk sueh 

as DOS 3.3 System Master 

l_? I Enter the Monitor with CALL -151. 

Insert Silent Sen-ice and type: 



[Z 



BLOAD \\, A$2200 



Turn on the printer, make a 
disassembly listing and turn off the printer: 

i repi 

2200LLLLLL 



fl lBPI 

A close look at the disassembly listing shows 
that this program has two possible outcomes. 
The check is OK and file G is BLOADED then 
filc^ is BRUN. 

The check fails, prints the "HARDWARE 
FAILURE" message and the program enters an 
endless loop. 

Beginning at offset byte $37 ($237) is where 
the checking code resides. The monitor 
SEEKABS ($B9A0) and RDADR ($B944) 
routines are set up and used to read track $21.5 
and $22. 

The addresses called in \\ are $F9A0 and 
SF944, respectively, indicating that DOS has 
been moved into upper memory. No data is 
read, just an address mark. 

The track number found in each read is 
compared to $21. If they match then everything 
is OK. This check can be defeated by placing 
a jump at $237 to jump over all of the checks. 

Search the disk for the hexadecimal string 
4C 3D 02 4C C2 02 . I found the bytes on track 
$03, sector $00, byte $3B. Note that the offset 
byte is $3B which is $04 more than S3 7 when 
the file is BLOADed, The first four bytes of 
any binary file give the load address and length 
in low/high form. This accounts for the offset 
on the disk being four bytes greater than that 
in memory. 

This bootup check can be defeated by making 
the following sector-edit: 



Trk Set Bytes From 
$03 $00 $3B- 4C 3D m 



To 

4C 9D 02 



The above was easy, but it is not all there 



is. A continuation of the boot alter the above 
edit brings the program to the main menus 
where the mission, difficulty level, et cetera are 
selected. 

The disk is then accessed again to load the 
particular mission selected. Just before the 
beginning of the play display, the protection 
tracks are sought again. This time the checks 
are more extensive with at least every hali-track 
between $21 and $22. S being accessed in a 
rapid, staccato lashion. 

A nonmaskable interrupt (NMI) capability is 
needed here to break into the program. 1 use 
the Senior PROM. When NMI-ed while 
accessing the protection tracks, the Program 
Counter is generally in page $97 or $98 of 
memory. 

A review' of the files in Silent Service reveals 
a binar\' file P that loads at $9500 with a length 
of $43A bytes; that is, it occupies memory from 
S9500 through S9939, It should be the tile 
containing the latter checks, 1 presume the name 
F means "protection". 

This file can be examined by using a normal 
DOS 3,3 environment and BLOADing it at 
$8,'>00 to prevent overwriting parts of DOS. 
The only problem is that garbage is displayed 
when it is disassembled indicating that the file 
is encrypted on the disk. 

Executable code has to be present when the 
file is being executed. Consequently, 1 NMI- 
ed the program while the protection tracks were 
being accessed and disassembled the code 
beginning at .$9S00 in memory. 1 printed out 
the enfirc file to study it. This is easy with 
Senior PROM. 

If I NMI the program at some other time and 
disassemble it, the same garbage is displayed 
as obtained when the file is BLOADed at 
$8500, 

After hours'of study I finally determined by 
brute force how the file is encrypted on the disk, 
1 haven't found the code that does the decryption 
while the file is being executed. 

The following example will define the 
method of encryption when BLOADed into 
memory and the corresponding decrypted bytes 
when the file is being executed: 

Bytes BLOADed; 

01 00 03 02 05 04 07 06 09 08 0B 0A 0D 0C 0F 0E , . . . 

Decrypted bytes: 
00 0I02 03 04 05 06 07 08 09 0A0B0C0D0E0F.,.. 

It can be seen that the bytes are reordered 
when decrjpted. The decrypted bytes arc the 
executable code. The BLOADed (encrypted) 
bytes .show the order of the corresponding bytes 
on the disk. Everything is executed in reverse 
order in much the same way a memorj' address 
turns out in reverse order when executed by the 
6502 microprocessor. 

Enemy Mine 

If the checks in P fail, the program continues 



but a player will .soon "ENCOUNTER AN ENEMY 
MINE". 

Many attempts to edit the code on pages $97 
and $98 resulted in failure. This is the code 
where the disk checks are being made, I finally 
determined that a RETURN near the beginning 
of P will do about as good as any. 

Whether or not the cany flag is set or cleared 
does not matter. Perhaps the condition of the 
Status Register when the program exits the 
checks does. Most addressing is done in an 
indirect manner through page $00, making h 
difficult to trace what is happening. 

In my efforts I used the feature of Senior 
PROM that moves pages $00 — $08 to pages 
S20 — $28 to preserve the volatile memory. 
It would be instructive for the interested person 
to study the F file and its use of page $00, The 
discussion that results is beyond the scope of 
this softkcy. 

Moving on with the approach used here, 
locate the beginning of P on the disk. Search 
the disk for the following hexadecimal string: 
08 20 08 95 85 68 60 FB. This is the beginning of 
P which is loaded at $9500. On my program 
disk it is located at track $0E, sector $OA, byte 
$04. 

Make the following sector-edit: 



Trk Set Bytes From 



ME $0A $06- 



To 



08 95 85 68 60 A9 95 85 32 60 
1 F7A9 18 85 02 

50 F9 



Incomplete Crack 

The above edit sets up memory location $F7 
and SF9 to match the values found there after 
NMI-ing the original when it exits the checking 
program. It then returns to the caller. 

This edit does not produce a complete 'crack' 
of Si/em Service , but it does yield a significant 
'bend.' The only problem left during the play 
is that occasionally after a convoy h attacked 
all the ships in the convoy will undergo a 
metamorphosis and change into destroyers. 

I I Copy Silent Serv'ice using any 

wliole disk copier that will ignore errors. 
Ijjcksmirh 6.0 FAST BACKUP will do this and 
leave the track/sectors with errors formatted. 



Using your favorite sector-editor, 
I use Locksrniih 6.0 INSPECTOR/WATSON, 
make the following edits: 



Trk Set Bytes From 

$03 $00 $3B- 4C3D02 
$0E $0A $06- 08 95 85 68 60 
1 



To 

4C9O02 
A9 95 85 32 60 
F7 A9 18 85 02 
50 F9 



The above edits temiinate access to tracks 
$21 — $22.5, If the original is copied with 
Locksmith 6.0 FAST BACKUP an indicated 
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above, track S22 will be left in a standard 
Ibrmat. Both tracks S21 and $22 could be used 
tor some other purpose if they were marked 
■free' in the VTOC. That is an exercise for 
someone who needs extra storage space. 

Reflections 

As metnioned above the procedure given 
herein is not a complete 'crack' of Si leu r 
Service. It does produce a playable backup with 
an added level of difficulty — the convoy ships 
changing into destroyers at certain times. This 
is exciting to the player. I have discovered that 
if I keep the submarine surfaced and fight it out 
with the destroyers using the deck gun, 
torpedoes, and brilliant tactics... about half the 
time I can sink all of them. 

(2) I called the previous section "The Known 
Protection" because 1 have always found 
another level of protection when I got one 
defeated. Presently, t have been unable to locate 
the code that turns convoy ships into destroyers. 
1 think that this aspect of the protection is unique 
and my hat is off to the protectors of Silcm 
Service. Maybe with what is given here a more 
perceptive deproteclor can 11 nd the protection 
that i.s stili present on the disk. Until then, this 
softkey produces a backup that one can enjoy. 

Softkey for... 



Rocky's Boots 10 

The Learning Company 



■ Requirements: 

U. 48K Apple II 

r; copYA 

II] A Sector-editor 

D A blank disk 

D Rocky '<i Booi.s v4.0 

Rocky'.',- Boots is an educatioftal prdgi-afn for 
persons 9 years old and up. It helps to develop 
skills in logical problem solving, abstract 
reasoning, and creative thinking. The gatnes 
that can be played or invented use concepts that 
are analogous to those used in computer design 
and machine language programming. These 
games can be saved to a storage disk for 
subsequent play or mtxlification. The storage 
disk can be initialized from within the program. 
This is an excellent prograin. Unfortunately, 
it is placed on a thin disk, and it is copy- 
protected. Registered owners can obtain a 
backup disk from the manufacturer for a fee 
(S12 plus $3 for shipping-handling). Since 
young (and old) users can destroy original 
programs, I decided to remove the protection 
so that legal backups can be easily made. 

The Protection 

The Rocky '.^ Boots disk has a slightly 
modified format. The address fields and data 



fields have epilogues of $FF SFF instead of the 
standard $DE $AA. This can be determined by 
using a nibble-editor. I use the Lock.\)nith 6.0 
DISK EDITOR. These epilogue changes will 
prevent any standard copier from copying the 
disk unless patches are made in memory to 
accommodate the modifications. 

Much can be learned sometime from 
watching and listening to the boot process. I 
have a Trak Star that shows the tracks that drive 
1 seeks. During the initial boot stage, the 
read/write head swings out to track $22 and then 
returns to track SOI. This is a sure indication 
of some kind of protection being on track $22. 

At this point I decided to normalize the 
program disk to facilitate working with it. This 
is easy to do using COPYA from the DOS 3.3 
System Master disk. Do the following: 



Boot the DOS 3.3 System Master 



or any other standard DOS 3.3 disk 



Tell DOS to ignore epilogues and 
checksum in READ mode: 
POKE 47426, 24 



Run COPYA from the System 



Master disk. 
RUN COPYA 

I ^ I Follow the prompts and copy 

Rixky 's Boots to a blank disk 

The backup just made will have normal 
marks. It will be able to be read by any sector 
editor without making patches. In general a 
copy juade this way will not boot until the 
epilogue marks in its RWTS (Read and Write 
Tracks and Sectors) are changed back to 
normal. In the case ofiiocA/'sStx^rA this is not 
true because its RWTS will read either altered 
or normal epilogue marks, as we shall see. 

At this point it is necessary to find and 
examine the code that controls the checks being 
performed when the read/write head swings out 
to track S22. The easiest way to do this is to 
interrupt the program while track S22 is being 
accessed. This program can be interrupted with 
a IBRESET "k eypress but it is noi easy to 
determine where the program was executing in 
memory this way I use the Senior PROM to 
interrupt programs because it can preserve 
volatile memory, and it can display the Program 
Counter and the contents of the accumulator and 
all registers. Also, the stack can be shown 
easily. 

Booting the copy just made shows that it 
hangs on track $22 and then re-calibrates and 
re-boots. An interrupt during track S22 access 
shows the Program Counter to be around $5652 
in memory with the first return on the stack at 
$4F33. This means that one must be added to 
this value to get the return address giving 
.$4F34. 

Examination of the code on page $56 shows 



that it is an image of DOS ,^.3 page $B9. 
Further examination shows that the designers 
&i RcKky's Boots have used pages SB8, $B9, 
and SB A of the DOS 3.3 RWTS and have 
located them at pages $55, $56. and $57, 
respectively. Of particular interest are the 
RDADR routine located at $5644 through 
$569F and the .SEEKABS routine located at 
$56A0 through $56FF. 

A disassembly of the code will not be given 
here in the interest of brevity. Anyone can can 
disassemble these codes from normal DOS 3.3, 
or a iBRESET "k evpres.s during track S22 
access will interrupt the program permitting the 
above memory addresses to be disassembled. 

Of greatest interest now is the routine that 
calls the above DOS 3,3 routines. This can be 
seen on page $4F of memory . 

The seek of track $22 is set up at $4F lO then 
the SEEKABS routine is called at S4FI2, More 
set up work is done in page S00, the drive is 
turned on. and the RDADR (read address field) 
routine is called at S4F3 1 . Note that this 
standard routine reads standard address field 
marks. On return from this rotitine sector $0F 
is ssmght, then particular bytes are looked for: 
SD5. SE7, $E7, $E7, and finally SEE. Now. 
the important part. If the checks fail, the Carry 
Flag is cleared at $4F8D and the execution 
branches to a lailure padn, re-booting at $4FD2. 

The only thing necessary to deprotect this 
program is to edit .$4F8D to set the Carry Flag. 
This will eircumvem all of the disk checks. In 
effect this tells the program that all is well no 
matter what is found on the disk. 



Use COPYA. or a .Super JOB 



Controller if preferred, to normalize and copy 
RcKky's Boots as shown above. 



: 



Search the disk tbf the hexadecimal 
string 18 90 3E A9 50 SD, This was found on track 
$00, sector SOI, byte $8D on my program 
disk. 



[ZZ] 



Make the folltjwinjg edit: 



Trk Set Bytes From 
$00 S01 S80 18- 



Tg- 
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This procedure produces a completely 
deprotected backup of Rocky's Boors As an 
alternative, the controller at the end of this 
article can be used with Super lOB 1.5 to 
accomplish the same task. 

Additional Discussion 

As a matter of future interest, another 
cheeking routine is found on page $5D, It is 
not used! It is almost identical to the checkmg 
routine found on page $4F as described in this 
article. I suspect that it has been placed there 
as an obfu scat ion factor or for use on some 
future version. 
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It is interesting to note the nature of the 
protection employed on track $22, sector $OF. 
Witliin the data field a large field of E7's is 
written. This field starts with a sync 50E7 with 
one framing bit. The next E7 is also a sync 
byte with one framing bit. Further on E7's 
with no framing bits and with two framing bits 
are found. 

Tlie dislc cotitroUer hardware should not lose 
synchronization but bytes different from £7 
should be read. This is a rather sneaky bit- 
game. Fortunately, it can all be circumvented. 
The framing bit analysis was done using the 
Locksmith 6.0 FRAMING BIT ANALYZER. 
a very useful utility. 

Parenthetically, a standard copier will not 
copy the sync bytes within a data field. All of 
the framing bits will be stripped off. The 
popular bit-copiers will attempt to reproduce 
the sync bytes; therefore, track S22 should be 
bit-copied to attempt to preserve this protection. 
It does not matter on the deprotected backups. 

Controller 

1000 REM RXKY ■ S BOOTS CONTROLLER 

1010 TK = :LT = 35 :ST= 15 :LS = 15 :CD = WR 

;FAST = 1 
1020 GOSUB 490 : RESTORE :GOSUB 170 :GOSUB 610 

:T1 =TK :TK = T1 + 6 : GOSUB 310 :TK = T1 
1030 GOSUB 490, ; GOSUB 230 : GOSUB 510 : IF 

PEEK (TRK) =LTTHEN 1050 
1040 TK = PEEK {TRK ) :ST = PEEK (SCT ) : GOTO 

1020 
1050 HOME : VTAB 11 :AJ = '-THAT'S'ALL'FOLKS'' : 

GOSUB 450 : END 
2000 DATA 255 ,255 ,255 ,255 
2010 DATA rCHANGES .0.1 ,141 ,55' 

Controller Checksums 

1000 - J355B 1040 - $DEE7 

1010 - $2544 1050 - JF0FA 

1020 - SE458 2000 - $9CC8 

1030 - SB573 2010 - S806A 



Softkey for. . 



Walt Disney Card & Party Shop 

Bantam Electronic Pitblishing 



■ Requirements 

C 64K Apple 

C NMI capability 

C Disk-editor 

n Sector-editor 

Zl 1 blank disk 

H Card & Party Shop 

The Will! Disney Card & Parry Shop (C&PS) 
i.s yet another of those type of graphics 
programs that Broderbund started with Print 
Shop. This one uses Walt Disney characters and 



allows a user to create invitations, tags, place 
cards, place mats, wrapping paper, banners, 
signs, awards, tickets, cards, letterheads, 
memos, po.stettes, and envelopes. It is a very 
user-friendly, menu-driven program with 

pictures of all the gra;)hics displaced in a 

window as they are considered. 
The program is on side A with graphics being 

on side B. Undoubtedly, future graphics disks 

will be released. 

The Protection 

As with all unknown programs I tried to copy 
C&PS first with Lock.<,tnith 6.0 FAST 
BACKUP. I use this one because it is quick, 
and it will continue to copy if an error is 
encountered while indicating the type of error. 
This procedure showed that all tracks copied 
without error except tracks $©3 and $ 1 1 . On 
each of those tracks address field errors were 
indicated for all sectors. 

Next, I used the DISK EDITOR within 
Locksmith 6. to examine tracks $03 and $11. 
Track $03 is a track full of a pattern that repeats 
every $40 (64) nibbles. The sync field at the 
beginning is very short. This is a track that 
could be used to cheek a signature or to nibble 
count. Track SI I is in standard 16-scctor format 
with standard marks except for the address field 
epilogue. The standard DEAA is changed to 05 
AA. 

From the PARAMETER selection in the 
LcKksmith Main Menu I patched DOS to ignore 
the epilogues and then used INSPECTOR/ 
WA TSON to further examine track S 1 1 , This 
is the track that normally contains the VTOC 
(Volume Table of Contents) and the 
CATALOG for the DOS 3,3 operating system, 
I looked at sector $00 first, the VTOC. 

Bytes $01 and $02 point to the track and 
sector of the first catalog sector. These bytes 
were 00 0F which is not normal . 

I then looked at sector $0F of track $11 
which is normally the first catalog sector. The 
catalog started there in a standard fashion. On 
the other hand, track $0© sector $0F contained 
code. At this point I edited the copy of track 
$1 1 sector $©0 byte $01 to be 11 instead of 
00 to point to the real first catalog sector. 

Escaping to the Main Menu, I used the DOS 
3.3 UTILITIES and cataloged the copy of 
C&PS. It came right up showing a disk full of 
files. 

With this knowledge it was obvious that the 
operating system of C&PS was nearly standard. 

While in Locksmith I wanted to check the 
bootup program. This is usually shown on track 
$01 sector $09 beginning at byte $75. Moving 
back into INSPECTOR/ WA TSON and reading 
track SOI sector $09 and then toggling the 
ASCII display key \~k\ showed that the bootup 
program is HELLO. 

At this point, I left Locksmitli and booted a 
standard DOS 3,3 disk. The DOS 3.3 System 



Master will suffice. The idea is to patch DOS 
to ignore the first address epilogue byte and then 
take a belter look at the HELLO file. This is 
done as follows: 

First, patch DOS to ignore the first epilogue 
byte when reading. ($B992:EA EA) 

PORE 47S06, 234 
POKE 47507, 234 

Now, let's c\&m\ne, HELLO . Load it. turn 
on the printer, CATALOG the disk, LIST the 
program, and turn off the primer, 

LOAD HELLO 

PR^l 

CATALOG 

LIST 

PIU>0 

The CATALOG shows a normal file 
structure of binary files except for the HELLO 
file. A binary file named START is included 
at the beginning of the CATALOG, The listing 
of the HELLO file shows a strange POKE to 
SEE on the zero page. The next line BRUNs 
SSPROT$$l which is a continuation of the 
protection. 

Examination ot'SSPROT$$l shows that it is 
the file that executes the disk -check of track 
$03, It searches for a signature and will fail 
if it is not found. 

It concludes by BLOADing SSPROT$$A. 
This file is a short file that is a binary load of 
a BASIC file. It is encoded so that it must be 
executed to see the real nature of the file, A 
nonmaskable interrupt capability is needed to 
examine this file. When this is done, 
SSPROT$$A is a file that does three things. It 
sets MAXFILES to I, CLOSES all files, and 
BRUNs START. 

All that has been done to this point 
demonstrates that C&PS u.ses a slightly 
modified DOS 3.3 operating system. The 
modifications can be determined as follows: 

Boot C&PS an d immediate ly reset into BASiC 
by pressing IBRESET . I lf this is not done 
immediately before the program is loaded the 
disk will re-boot. The RUN flag is set 
somewhere. 
Call -ISl 

Move the modified RWTS (Read and Write 
Tracks and Sectors) into lower memory out of 
the way of a re -boot, 
480<t<B8<IIO.BrFnVI 

Boot a standard DOS 3.3 disk, reset into 
BASIC. 

e rspl 

rSCl wr [BRESET I 

Enter the monitor and compare the altered 
RWTS with the standard RWTS, 
CALL -151 
4800<B800.BFFFV 
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The comparison shows that $B992.$B993 has 
heen changed from D0 AE to EA EA, This 
confirms what has already been determined; 
namely, the first byte of the address epilogue 
is ignored in the read mode. The comparison 
will also show that pages SBB and SBC are 
difterent. These pages are buffer areas used by 
DOS 3,3 and the differences are unimportant. 

To summarize, the protection used on C&PS 
is modified address epilogue marks on track 
$ 1 1 ; a disk check of track $03 for a signature 
executed from the file SSPROTSSI; and the 
binary file SSPROT$$A which is in reality a 
BASIC file disguised as a binary one. This last 
file sets up the machine for the execution of 
START, the real startup program. 

The Softkej 

Frorii the above description of the protection 
this program can be normalized by transferring 
the files to a standard DOS 3.3 disk that has 
been initialized with a null HELLO bootup 
program. Do the following; 



Boot a DOS 3.3 disk, preferably a 
fast DOS such as Diversi-DOS. 



Clear memory. 



NEW 



I ^ I Place a blanl< disk in the drive and 
initialize it. 

INIT HELLO 

I ^ I Modify DOS to Ignore first 
epdogue byte when reading. 

POKE 47506, 234 
POKE 47507, 234 



I ^ I Remove the initialized disk, in.sert 
the DOS 33 Master disk and BRUN FID. 

BRUN FID 

I ° I Follow the prompts and use the 

wildcard = to transfer all of the files from the 
original C&PS to the initialized disk. 

I " I Make the following sector-edits to 
the copy using your favorite editor; 



Trk Set Bytes From 

...111 %m S01 00 

J40- 00 00 
$44- 00 00 



Tq 



11 
FFE0 

FFFF 



I ° I Enter BASIC, key-in, and SAVE 
the following HELLO program tp. the cppy. 

5 D$ = CHS$ (4) 

ID PRINT DS"MAXFILES 1" 

2D PRINT DS'<CLOS&" 



3D PRINT D$"BRUN START" 

The above produces a completely deprotected 
version of side A to C&PS. A further 
refinement would be to DELETE the files 
SSPROT$$! and SSPROT$$A to make more 
room on the disk. However, this is not 
necessary. 

For those that have SUPER lOB i.J, install 
the Controller at the end of this article to do 
all the grunt work described above. For the 
Super JOB method a disk must be initialized 
first with a null HELLO file as described above. 
Again, it is preferable to use a fast-DOS to 
.speed up the loading of the binary files. This 
will be the copy disk to use when running Super 
lOB. When the copy is done, key -in and SAVE 
the HELLO file at the end of this article to the 
copy. 

Side B is unprotected. It can be copied with 
any standard whole disk copier such as FAST 
BACKUP ur COPYA . 

Discussion 

As a matter of Interest, a protected backup 
of C&PS can be produced as follows using 
Locksmith 6.0: 



Controller 



$22 



ZK 



FAST COPY tracks $00 

J BfT COPY tracks 503 and $11 
using default values. 

Usually the copy of track S03 will fail or a 
short track with a length of about S1600 
nibbles will be written. This will fail to puxiuce 
a successful backup. The length of the track 
written to the copy must be in the range of 
S18F0-S1900 nibbles. 

Time can be saved by entering the DISK 
EDITOR and reading track S03 into the buffer 
from the original. 

Use the fast movement of the cursor to find 
the excuse for a sync field. 

Set the track start manually at the beginning 
of this. Set the verify start at the first nibble 
following this field. 

Move back to the track start and move 
forward S1900 nibbles In the buffer. The 
ragged sync field should be near. 

Set the track end at the end of the normal 
nibbles before the sync nibbles start. Write the 
track back to the copy. This procedure will 
produce a successful protected backup... 

Disney's Comic Strip Maker 

Bantam Electronics is also distributing a 
companion program called Walt Disney Comic 
Strip Maker. More than likely it has the same 
or a similar protection on it that C&PS has. If 
the program is file-based and the DOS is 
modified somewhat, the files can be liberated 
in a manner similar to the method used in this 
softkey. This is especially true if the major 
protection is contained in files as it is in C&PS. 



1000 REM CARD & PARTY SHOP 

1010 TK = 4 .LT = 35 :ST = 15 :LS = 15 :CD = WR 

: FAST = 1 
1015 POKE 47505 .234 : POKE 47507 ,234 
1020 GOSUB 490 : RESTORE ; GOSUB 510 :TI = TK 

;TK = T1 +5 : GOSUB 310 :TK = T1 
1030 GOSUB 490 : GOSUB 610 : IF PEEK (TRK ) = 

LTTHEN 1050 
1040 TK = PEEK (TRK ) :ST = PEEK (SOT ) : GOTO 

1020 
1050 HOME :AJ = "SAVE' THE' rJEr HELLO' FILE' 

TO' THE' COPY." : PRINT : GOSUB 450 
1055 PRINT :AS = "THAT'S' ALL' FOLKS" : PRINT 

. GOSUB 450 : END 
2000 DATA 5'CHANGES 
2010 DATA 17 ,0 .1 ,17 ,17 ,0 .64 ,255 ,17 ,0 

,65 ,224 .17 ,0 ,58 ,255 ,17 .0 .59 ,255 

Controller Checksums 



1000 - $356B 

1010 - S2744 

1015 - S1DD4 

1020 - SE0D0 

1030 - SF252 



1040 - J53AE 

1050 - $FA5D 

1055 - $1D75 

2000 - $8BC7 

2010 - S53FA 



, Using . 



5itfef Hard Drives, 

3V2" 80OK Drives, 

and 5V4" Drives 

in a DOS 3.3 environment 



II Requirements 

n Apple He enhanced 

D Sider 10MB Hard Drive 

n 31/2" 80OK Drive with Univer.sal Dhk 

CoiitroUcr (Central Pomt Software) 
IZ Two SVa" Apple Disk II Drives with Disk 

II Interface Card 
n UniDOS Plu.'i (MicroSPARC) 
D DAVID-DOS 11.2 (David Data) 
n SiderWarc Support Utilities for DOS 3,3 

Tlie Problem 

The DOS 3 .3 operating system for the Apple 
II series computers was the standard for a long 
time. However, ProDOS has gradually become 
the preferred operating system. This Is due to 
the fact that ProDOS facilitates file 
manipulations on hard drives, Vh" drives, 
5W drives and combinations thereof. 

Conversely, DOS 3.3 doe.s not recognize 
3'/2" drives and does not employ the hicrarchal 
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file structure inherent in ProDOS, However, 
those that still extensively use DOS 3.3 have 
a need for a DOS 3.3 modification that will 
permit file manipulations among the various 
type drives mentioned above. This need has 
been partially addressed by the software defined 
above. 

The objective of this article will be to 
derive a procedure that does permit IK)S 3.3 
operations among all the type of drives 
mentioned above in the hardware 
requirements. 

MkroSVARC's UniDOS Plus 

UniDOS Plus, developed by MicroSPARC, 
solves some of the problem. It is a very 
compatible modification of DOS 3.3 that 
recognizes 3'/:" drives. Ufiliues are included 
on the disk that permit more-or-less normal 
operation with 3 '/j" and 5 W" drives in a DOS 
i.i environment. 

A modified FID is included on the disk that 
permits access to drives 3 and 4 installed on the 
VA" disks. Surprisingly, this modification does 
not provide for the independent specification of 
the volume number. 

When the V/i" disk is formatted with the 
INIT command one 40OK volume is placed on 
side 1 of the disk. Another 400K volume is 
placed on side 2, Side 1 is accessed as drive 
1; side 2 as drive 3. If a second 3 '/z" drive is 
daisy -chained off of the first; side I of it is 
accessed as drive 2; side 2 as drive 4. 

However, whh all of these good features, the 
DOS 3.3 partition of the hard drive cannot be 
accessed from the Vh" drive. 

David Data's David-DOS lU 

David-DOS 11.2, developed by David Data, 
is a modification of DOS 3.3 that speeds up the 
loading and saving of all file types. 

Twelve commands have been added that 
improve basic DOS. One of these isHIDOSthat 
moves DOS to the Language Card and 
continues operations of programs. 

A number of useful ufilities are included on 
the disk. An applcsoft program named MAKE 
BRVN-ABLE DOS is of particular interest. Its 
purpose is to capture the DOS resident in 
memory as a binary file that is BRUNablc, It 
is set up to capture DOS 3.3 or David- DOS m 
low memory and David-DOS in high memory. 
These binary files can be transferred to a hard 
drive and executed there to install the particular 
DOS desired. 

SiderWare's Hard Drive Support 

SidcrWare Support Utilities for Apple DOS 
3.3, provided with the Sider hard drive, 
provides several very useful utilities. 

A modified /7Z? is included that does permit 
the specification of volume number as well as 



slot and drive numbers. A patch to the program 
DOS FILE UTILITY is given on page 12-8 of 
the latest manual to defeat slot checking. This 
utility contains the modified Fro program. The 
Technical Assistance Personnel give an addition 
to this patch for those using the Universal Disk 
Controller (UDC). For clarity the patch is 
repeated here: 

UNLOCK DOS FILE UTILITY ,V1 

BLOAD DOS FILE UTILIIT 

CALL -151 

4812:EA EA EA N 4S16:94 

51A7:ffl7/wL'DC 

E003G 

BSAVE DOS FILE U'nLITy,A$48<9<9,L$lSA6 

LOCK DOS FILE UTILITY 

The Sider supports other operating systems 
in its DOS 3.3 partition such as Pronto-DOS.. 
Diversi-DOS, and David-DOS and provides 
programs or instructions for the installafion of 
these DOS modifications. 

Of course, DOS 33 is the default operating 
system. If other modificafions of DOS 3.3 can 
be installed on the Sider, why not UniDOS 
Plu.<l If possible, this might solve the access 
problem previously described. 

The approach 

'fhe plan is to get UniDOS Plus into memory 
by booting the [/h/ZJOlS' /'/i« disk from the 3'/:" 
drive. 

Insert David- DOS IT 2 in the S W " drive and 
RUN MAKE BRUN-ABLE DOS. 

Answer the prompts and capture UniDOS 
Plus as a binary fde. The program will think 
that UniDOS Plus is DOS 3.3. The file that is 
captured is called LO DOS .?.,^. It should be 
renamed LO UNIDOS -I- on the disk and copied 
to the Sider drive and volume desired. 

Also, transfer the HELLO file from the 
UniDOS Plus disk to the 5'A" disk, rename it 
HELLO.UNIDOS-I- . and copy it to the same 
drive and volume on the hard drive. 

At this ptiint these files cannot be copied with 
UniDOS Plus resident in memory. It is best to 
reboot into the Sider mvi. use its support utilities 
to copy the files from the 5M" drive to the 
desired Sider drive and volume. 

Theoretically, the binary file, LO 
UNIDOS+, can be BRUN to install UniDOS 
Plus on the hard drive. When this is done the 
hard drive does have UniDOS Plus resident, and 
it works fine except for accessing the ^'/i" 
drive. 

The plan seems to have failed. After much 
frustration and experimentation. UniDOS Plus 
was installed on the hard drive and persuaded 
lo access all drives. This was done as follows: 

After the above steps were completed, the 
3 Yi drive was accessed by issuing the PR#sr 
command with the UniDOS Plus disk in the 
drive, (x is the slot of the 3'/^" drive.) This 
warm boots the 314" drive from the hard drive. 



As soon as the boofing process is complete 
and the BASIC prompt 1 appears, issue another 
PR#/ command, (y isthesloi number of the hard 
drive.) This warm boots the hard drive into the 
DOS 3.3 partition. BRUN LO UNIDOS + again. 

When this is done all drives can be accessed 
and files manipulated among them. 1 do not 
know why the round trip to the 3'/;" drive is 
required, but it works. 

I have discovered that the reverse process 
will work also. In other words, start by booting 
UniDOS Plus on the 3'/2" drive. Make the 
round trip to the hard drive in a manner similar 
to ihat previously described and everything will 
work fine. Apparently, this process initial i7es 
the interface cards some way. 

Step-by-step 

The following is a step-by-stcp procedure for 
successfully installing UniDOS Plus in the DOS 
3.3 partition of the Sider hard drive: 



I Boot UniDOS Plus from the 3'/:" 

This gets UniDOS Plus resident in 



drive 
memory. 

I ^ I Insert David-DOS If. 2 in the 5 W ' ' 
drive (S6, Dl) and: 

RUN MAKE BRUN-ABLE DOS,Se,Dt,V254 

Remove the David-DOS disk and insert 
another DOS 3.3 disk to save the binary' file on. 

Follow the prompts. Answer Y to the 
question about creating LO DOS ,?..?. 

Enter the sloi number of your hard drive at 
the proper time. 

Enter for the volume number. 

Enter HELLO, UNIDOS + as the Hello file 
name. 

Enter the type of Hello program: BASIC. 

Choose the hard drive. 

Then, press the final JRETURMl . 

When the process is complete, LO DOS 3.3 
will have been saved to the DOS 3.3 disk and 
the BASIC cursor 1 will appear. 

[ 



Now: 



RENAME LO DOS 3.3,LO UNIDOS + 



Load the Hello program from 
whatever Drive x your 3 W" drive is in. Mine's 
in slot 4. 

LOAD I]ELLO,Sir,Dl,VZ54 

l_5 I and: 

SAVE HELL0.UNID0S + ,SG,D1,V2H 

l_~ I Now the warm- hoot the hard drive, 

with X as its slot. 

PRffi My hard drive is in sloi 5 

Follow the menu to gel the DOS FILE 
UTILITY up and running. 
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Transfer HELLO. UMDOS+ and 
LO UNIDOS+ from S6,D1,V254 to 
S5,D1,V1, 

l_? I Finally: 

BRUN LO UNIDOS + ,S5,D1,V1. 

UniDOS Plus is now installed from the hard 
drive. It will work with the hard drive and the 
5 W" drives. 

It will not yet access the VA" drive. 

I ^ I WariTi-b(x)t the 3 ',4 " drive with the 
UniDOS Plus disk in the drive: 
PR#4 

I ^*^ I At the cursor: 

...And warm boot the hard drive again and boot 

inio DOS 3.3: 

PR#5 

PR#6 



I 11 



And again. 



BRUN LO UNIDOS + ,S5,D1,V1 

At thi.s point UniDOS Plus will function 
normaliy with all drives. 

The Sider Support Utilities Can be used to 
perform all file manipulations with any 
combination of disks. 

After UniDOS Plus has been captured as a 
binary file and the files have been copied to the 
hard drive, the other steps in the procedure can 
be simplified as follows: 

A) Modify the HELLO program on the 
UniDOS Plus disk to provide the option of 
returning to BASIC or of warm booting the hard 
drive. 

B) Similarly, modify W£'iiO.MVro05+ to 
provide the options of continuing with Sider 
operations, warm booting the 3'/i" drive, or 
returning to BASIC. 

Discussion 

The objective of defining a procedure for 
performing normal DOS 3.3 operations using 
any mix of the drives identified in the Hardware 
Requirements section has been laboriously 
achieved. 

It works using the off-the-shelf software 
described. 

Apparently, the patch to DOS FILE 
f/77L/TK provided by First Class Peripherals 
does not work with the UDC from Central Point 
Software, The necessity of making the round 
trip of warm boots between the hard drive and 
the 3'/i" drive to initialize the interface cards 
is puzzling. Certainly the technical knowledge 
of how to accomplish the disk access is known 
because it is routinely done in Pro DOS. 

I would suggest that one of the manufacturers 



discussed herein solve the drive access problem 
defined in this article in a more straightforward 
manner. 

While this procedure works for the specific 
hardware system setup described, it will most 
likely work with other setiips. 



Willem Moolenaar 



Softkey for.. 



Commando 

Data East 



[T 



checksums. 



Make DOS ignore end marks and 



POKE 47426, 24 

I ^ I Run COPYA from your DOS 

master disk. 

I 3 I Make the following sector edits: 



Trk Set Bytes From 



To 



m S06 $4B 


D0F4 


EAEA 


$54 


DC 36 


EAEA 


S5D 


00 2D 


EAEA 


%n 


D0F4 


EAEA 


J7B 


D0 0F 


EAEA 



A.Ptybn. 



Commando 

Data East 



Unlimited Men & Grenades 

The first edit is for unlimited "Arnold 
Schwarzeneggers'" (men) and the second is for 
unlimited grenades. 

To 



Trk Set Bytes From 

$1C $09 $52- E9 01 
$79- E9 01 



EAEA 
EAEA 



Softkey for... 



Infiltrator U 

Mindseape 



[TZI 



Make POJ? ignore end marks and 
checksums, 
POKE 4742G, 24 

I ^ I Run COPYA from your DOS 
master disk. 



I ^ I Make the following sector edits: 

Trk Set Bytes From To 



$00 $03 $42 
$00 $08 $AF 



38 

A9 



18 
60 



Softkey for. . 



Street Sports Baseball 

Epyx 



[T 



Make DOS ignore end maiks and 



eheckstims, 
POKE 47426, 24 

1 ^ I Run COPYA from your DOS 
master disk, 

I 3 I Make the following sector edits: 



Trk Set Bytes From To 

$.00 $05 $43 
$4C 
$55 
$68 



D0F4 EAEA 
D0 4A EAEA 
D0 4I EAEA 
? EA EA EA EA EA £A A9 FC 

85 F0 85 F3A9EE85 Fl 

85 F2 



Softkey for, , 



Championship Wrestling 

Epyx 



I ^ I Make DOS ignore end marks and 
checksums. 

POKE 47426, 24 

Rtm COPYA from your DOS 



d: 



master disk. 

3 I Make the following sector edits: 



TrK Set Bytes From 



To 



$00 $06 $43- 


D0F4 


EAEA 


$4C- 


D0 3E 


EAEA 


$55- 


D0 35 


EAEA 


$68- 


D0F4 


EAEA 


S7C- 


A5F4 


A9E7 



Softkey for.. 



Portal 

Act i vision 



Trk Set B.ytes ?tm 



To 



ill $01 $B8- 49 AA 



A9 55 
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Sofikey for... 



Aliens 

Activision 



Trk Set Bytes From 
^S0B ME $9D- 49 AA 

Safikey for. . , 



To 



A9 55 



Tass Times in Tonetown 

Activision 



Trk Set Bytes From 
jai $0A SA4- 49 AA 



To 



A9 55 



Softkey for.. 



GFL Cliampionsinp Footbaii 

Game star 



Trk Set Bytes From 
SIB %m 195- 49 AA 



To 



A9 55 



Softkey for. . 



GBA Ctiampionship Basketbail 

Gamestar 



Trk Set Bytes From 
m J0A 196- 49 AA 



To 

A? 55 



Softkey for.. 



Manic Mansion 

Luc as film 



Trk Se.t Byt^.s From 



To 



100 SBC $98- 49 AA 



A9 55 



The ahtwc {scaning for 49 AA) will most 
pi'obably work tor other new Activision and 
Activision ciistribiitcd games! 



T. F. Blake 



Softkey for. . 



Bard's Tale I! 

Electronic Arts 



\^3 



Get out a sector editor and make the 



following changes. 



Trk Set Bytes From 



1 $0C $00- 


4C 59 05 


1 $0F $00- 


4C 69 A0 


S69- 


4C 69 A0 



To _ 

18 60 DD 
18 60 OD 
18 60 DD 



It is now COPYA-abic. 



William O. Romine 



Capturing 

LoclismitJi FastCopy 

For Ilgs 

a notf on Jerry Lewis'... 



Capturing... Locksmith 6.0 Fastcopv 

COMPUTIST H^, Page 12 

After reading Mr. Lewis's article I 
immediately followed his instructions and made 
a working binary file of Fastcopy 6.0 but it 
would not run on my llgs but ran fine on a //e. 

Shortly after this I received a modification 
patch from Alpha Logic for my Locksmhh that 
fixed Fastcopy where it would run on the Ilgs 
- well and good. But a binary file made by Mr. 
Lewis's procedure would not run on the Ilgs. 

I then made a copy of Lock.<;mhh STARTUP 
and FASTCOPY by Mr. Lewis's method 
outlined in his article, I then compared them 
to the same files from the binary file that would 
run on the //e. 

Comparison was made by entering the 
monitor, bloading the file FC (Hgs) at S4000, 
BLOADing the file FC (lit) at $60O0 and 
doing a monitor compare. The following bytes 
were found to be different. 



address: 


FC Ilgs 


FC//e 


$405 A: 


ID 


08 


$4FBC: 


18 


EE 


.MFBD: 


90 


D0 


S4FBE: 


35 


07 



Copy disk wilh Copy II Pius. 



After studying these changes, I found that the 
only change that seemed to matter was the (08) 
to ID. This caused a jump to S1DG)0. For 
there to be the proper file at $1D©0 the re.st 
of FC had to be included in the binary file and 
LS START would move it to the proper 
position. So the boot procedure was followed 
and FC was saved. 
SAVE FC, ASaOOO, LSlSFD 

The above memory comparison was made for 
LS START. There were only 8 bytes different. 
They were a!! from $4003 to $4O0B, FC was 
longer now and changes had to be made in LS 
START. The memory move was changed to 
move in the new length of FC. A couple of extra 



bytes were included in the final Fastcopy binary 
file beyond the necessary file length. 

Two bytes were changed in the move routine 
in LS START so that all of the new FC file 
would be moved. Follow Mr. Lewis's 
instructions bui u.se the following text file with 
its changes. (Be sure to add the nccessai^' length 
to the FC file when you copy it). 
MON C,I,0 
CALL -ISt 

0800:22 N OSOKOSOO.SOOOM 
BLOAD LS START,A$4000 
BLOAD ONE SIX,A$4484 
BLOAD FC, AS5000 
2014<400C.4011M 
201A<402F.4034M 
2025<4051,40SDM 
203S<416e.4330IVI 
2206<BOOO.S03FM 
224e<&03D.50SAM 
2264<4484.44A3M 
22S4<50FE.e8FDM 
ZmO:AO 00 as 99 00 OC C8 DO 
2003:FA EA EA EA EA EA EA EA 
2010:EA A9 EA 78 
201B:3S 20 

201E:24 21 AD E9 B7 85 6D 
203Z:4C 06 22 
2045:76 20 
2086:09 21 
2eA9:OB 21 
20CA:0B 21 
20E7:09 21 
20FA:4C 20 
20FF:76 20 
2104:76 20 
2107:47 20 
2141 :CF 21 
220D:71 22 
2244:83 

ZZ46:3E AO 84 84 3C AO 00 
224E:42 
2254:22 
2258:3A 
2273:64 22 

BSAVE FASTC0Py,Ail2O00,L$lB00 
3DQG 
NOMON C,I,0 

Note: Have the neccessary files on the same 
disk as this text file before you EXEC it. This 
text file presupposes that the Fastcopy mixle to 
a Binary File had already been modified for ihe 
//gs. If a l/e copy is to be changed one would 
need to add to the text file: 
2263:1D 
3142: 18 90 35 

I have not tested this latter, but it should work 
to convert a //e to a Ilgs binary file. 

^-^ Finally, I have riot yet figured out hoW 
to get the file to read the extra memory in the 
//gs. If someone has the answer I am waiting. 
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Edward Teach 



Softkey for. . 



The Eidolon 

Epyx 



■ Requirements: 

D COPYA 
D Blank disk 
D sector-editor 

I am sure that anyone who iias deprotected 
a piece of software has iieard "How did you 
do it'?". That question is usually asked by the 
person who equates computing with scoring a 
7,i1lion points in Zaxxon. I was that person just 
four months ago. After all, I had a sector-editor 
and had heard of assembly code. 

Deprotection had to be easy, right? For the 
last four months, I have spent my waking hours 
with several items. These were Hardcore 
Computist, Beneath Apple DOS, Assembly 
Lines and my trusty II Plus. In that time I 
nianaged to free a few minor items. 

Most of them were deprotected simply by 
using Ray Darrah's Super I.O.B. (nice piece 
of work Ray) , Changing an epilogue here and 
a prologue there was all that was necessary. If 
you know what an epilogue and a prologue arc 
ihen give yourself 5 cracking points. The rest 
of you go back and reread old copies of the 
COMPUTIST. 

So after four months I now know the answer 
to the "How did you do it?" question. The 
answer is that it is easy to liberate software. The 
hard part is obtaining the information and the 
knowledge to make it easy . 

Just as with the master crackist who makes 
his skills look simple, they were developed 
through hard work and training. So now that 
I have advanced from the novice to the rookie 
level, here is what I have learned: 



You must make a COPYA version 
of the disk. To do this, RUN COPYA from your 
DOS master disk. When the disk stops, press 
IQC I to stop the program. Delete line 70 and 
defeat DOS error checking. 
70 

POKE 47426,24 
RUN 

It is difficult to examine a protected disk. 
Making the COPYA disk usually entails sed:ing 
the prologues and the epilogues to a normal 
format. The Super I.O.B. is also excellent for 
this purpose. 



runs then congratulations. If it doesn't run go 
to step three. 

I_? I What docs the disk do during the 

boot? Does it boot then reboot then reboot. ..? 
Does it boot to the title page then hang up? Does 
it appear to access the disk? 

If the disk keeps rebooting then try searching 
for code that jumps to memory location $C60O 
(the reboot code) or, if the disk spins before 
hanging up try to locate the code C08C or C08E 
these locations must be accessed before the disk 
can be read. If you get the title page then the 
program hangs up, try to locate 0357. Thi.s 
location turns on the hi-res screen. If the code 
runs until a keypress is needed, then search for 
C000. This is the location a program checks to 
sec if a key was pressed and to get that keys 
value. 



lAi J 



I Remember thai addre.ises in the Apple are 
.stored with the Lo-byie first. I.E. $C600 is 
stored as 00 C6 in memory. Also, some 
programs refer to the disk controller I/O 
locations directly in.stead of indexing from 
$C&SX. A direct read access to a disk controller 
card in slot 6 would be $C0EC or EC C0 in 
memory RDEXed 



\JZ1 



[^J 



Boot your COPYA version. If it 



Disassemble the code and try to find 
what needs modification. By noticing what 
happens when you boot your COPYA version 
gives a clear indication as to what to search for 
on the disk. From there you can begin your 
disassembly. 

As a practical example of what all of this 
means... on to the deprotection. 

The Eidolon is a quality software game froin 
Lucasfilni and Epyx. One of the more 
interesting features is that as you advance 
through the tunnels the hi-res screen scrolls 
smoothly and maintains perspective (an 
excellent programming technique). 

The protection scheme involves a change in 
both the address and data epilogue marks. 
Instead of the normal DEM, Epyx uses FF FF. 
This is an easy task for the Super I.O.B. to 
reverse. 

Make a COPYA version with the correct 
epilogue marks and boot the copy. You will 
immediately notice that your disk drive has gone 
to reboot heaven. Press [ RESET] to stop the 
drive. 

Evidently the people at Epyx decided that 
since they went to the trouble of changing the 
epilogues, then they might as well check them 
during the boot. If the marks have been changed 
then the disk reboots, checks again then 
rebo<its . . . 

Interestingly, it would appear that by 
rebooting Epyx expects the marks to magically 
transform back to the FF FF that they expected. 
If you have ever been in the monitor and typed 
C600G, you know that this will boot drive 1 . 



Knowing this, 1 decided to scan the disk for a 
jump to location $C600. Hopefully, this would 
be etxied as either 4C 00 C6 (Jump $C6O0) or 
as 20 00 C5 (Jump to subroutine $C60O), 



%, 



I Don't forget to check for an Indirect jump 
to $C600. It looks like this: 
IMP ($XXXX} where XXXX is a location in 

memory that contains the actual address 

von want ($C600} 



300: 6C04 03 
304: 00 C6,,., 



JMP (10304) 



.RDFJfd 



Both the INSPECTOR and the Bag of Trict<; 
will scan the disk for these specific bytes. I 
assumed that since the reboot was 
instantaneous, then the code I needed to locate 
would be in the DOS image on tracks 
$O0— $02. A scan of the disk reveals that track 
$01. sector $0F, bytes SOS, $06 and $07 
contain the code 4C 00 C6, 

This sure looked like the reboot code to me. 
My first thought was to replace the 4C 00 Cg 
with £4 EA EA. This would tell the computer 
to perform no operation at that location, I 
changed the three bytes to EAs and wrote them 
back on the disk. 

Then I typed PR#6. The drive made several 
funny noises and I waited for the reboot. 
Instead, I was given the title page and sent off 
to explore the caves. 

Now I had a COPYA version of a really good 
game. The only difference between the original 
and my copy was 'protection* and a few extra 
head clacks. The extra clacks on my copy 
bothered me. Did I miss something important? 

A disassemblv of the code revealed: 



0800: 


20 FD 0E 


JSR J0EFO 


0803: 


90 03 


BCC J0808 


0805: 


4C00C6 


JMP K600 


0808: 


20 14 0B 


JSR $0B14 



Evidently line $08O© jumps to a subroutine 
that cheeks the epilogue marks. If they have 
been altered (which we did) then the carry bit 
is set and the code returns via a RTS (return 
to subroutine) to S0803, This line says that if 
the carry is clear then jump over the reboot 
code. 

When we changed tine $0805 to EAs we 
failed to clear the carrry bit. This could cause 
problems if Epyx later checks the carry bit. 
Instead we can make line $0805 clear the carry 
bit, Ihen the code at $0803 will not matter. To 
do this we change $,0805 frpm 4C 00 C5 to 18 
EAEA. 



Trk Set Bytes From 



T0. 



$01 J0F $05-07 4C00C6 



18 EAEA 



The 18 clears the carry bit and then falls into 
the branch to the start of the game at $O808. 
The disk will no longer reboot since that code 
does not exist. 
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A disassembly would now show: 



0800: 


20 FD 0E 


JSR S0EFD 


0803: 


90 03 


BCC $0808 


0805: 


18 


CLC 


0806: 


EA 


NOP 


0807; 


EA 


NOP 


0808: 


20 14 0B 


JSRJ0B14 



Writing this to the disic gives only one head 
'clack' (like the original). This so ft key works 
on this disk. 

However, I should stress that I did not 
disassemble any of the code at $OEFD (the code 
which verifies the epilogues). Luckily, Epyx 
decided to allow the code to simply check the 
epilogues then return to $0803. They could 
have easily stored a number in a certain memory 
location and then checked during the game to 
see if the number matched what they placed 
there. If the numbers did not match then it 
would be obvious that tampering had occurred 
and the game could be sent off in some endless 
loop. 

This is why we did not simply remove the 
jump to the offending code. It seems easier to 
clear the carry bit then to decipher and rewrite 
the "check the epilogue code". 

So when you deprotect your copy of The 
Eidolon trace the code. For the beginner it will 
be well worth your trouble. 

To trace the code, make a COPYA version 
of your original. Using your sector-editor 
change track $01, sector S0F, bytes $0O— 
02 from 20 FO 0E to 00 00 00. The 00 byte is a 
software BREAK instruction and will force the 
program to stop. You should end up in the 
monitor. 

Type EFDL and press I RETURN! . 

You're on your own now. As for me, I'm 
off to explore the caves, 

Softkey for... 



The AmericBtt Challenge 

Mind scape 



By setting the epilogues to a normal format, 
scanning the disk for "C600", then 
disassembling the sector, it is easy to see that 
changing a few bytes will deprotect the disk. 



Trk Set Bytes From 



To 



i00 J0B $88-8C D0 F8 4C 00 C6 EA EA 4C DB 43 



See, it gets easier all the time. 
Softkey for... 



Saracen 

Datasoft/ Intel Hcreat ions 



This is a nice arcade game, but unfortunately 
protected. The epilogues and prologues are 



normal, but the checksum of the data header 
and the address header were wrong. Also the 
volume number on eacii track was 44. The 
Super lOB will easily make a COPYA version. 
(Which is always my first step when 
deprotect ing a disk). Booting the COPYA 
version causes "eternal spin'. The secret to this 
crack lies in the lOB, (If you don't know what 
an lOB is, then you need to buy a copy of 
Beneath Apple DOS). 

Anyway, the byte to change in the lOB is 
located on track $0O, sector $01, byte SIO, 
Change this byte from a 44 to a 00. Write this 
back to the disk and enjoy. 



Trk Set Bytes From 
$0 $1 Jl0 44 



W 



m- 



As a side note you may want to boot up a 
sector editor and read the disk. The author not 
only put his name in the sectors, but also his 
home address (in France) and his phone 
number. If he did not want you to break this 
disk and let him know then why bury your name 
on a protected disk? 

Softkey for... 



Bop & Wrestle 

Mind scape 



Usually when I am working on a disk I keep 
good notes. The firsi rule of deprotection - 
know what you did. So I broke the rule. The 
epilogues are all FF FF. (Header and Address). 
The Super lOB can fix this. 

But what the author also did was to chartge 
the read table - located at $BA96— BAFF. So 
you have to boot the original disk, break into 
the monitor and copy the read translate table 
,so you can place it into the Super lOB. 

Like I said, I broke the rule and did not write 
this down. Either prim it out or write it down. 

Now boot up Super JOB and exec in your 
controller. Enter the monitor and type in the 
read translate table. 

When you are done typing press I SC I and 
type RUN. This will deprotect the Bop& Wren tie 
original. 

ALso, if you decide to abuse the hi-res 
banner I would appreciate a ' 'Thanks to Edward 
Teach'. 

Softkey for... 



Top Fuel Eliminator 

Gamestar/A division 



1 love disks that are COPMable but the copy 
will not run. This usually means that the 
protection is a nibble count of some kind. To 
locate the nibble routine search the disk for 
case. On Top Fuel Eliminator (TFE) these 



bytes show up in the DOS image (tracks 0-2) 
and also in track 16 sector E. The code here 
shows: 

08A8- BD8CC0 LDA C08C,X 



08AB- 


10 FB 


BPL S08A8 


08AD- 


38 


SEC 


08AE- 


2A 


ROL 


08AF- 


25 FC 


AND SFC 


0SB1- 


49 M 


EOR #?AA 


0883- 


8DD4 30 


STA $30D4 



What this routine does it to locate a .specific 
nibble, manipulate it and store the final value 
at $30D4. While I didn't search the disk, there 
is code which accesses that location. 

To find the value stored at S30D4 I placed 
a break 00 at location $08B3, then booled the 
disk. The 00 will cau.se the program to stop 
and also it will display the contents of the 
registers. 

After the beep, I pressed I RESET I to clear 
the hi-res screen and was shown that A = 55. 
The patch needed was to replace the code at 
$08B1 (49 AA) with die new code (A9 55). 

Gentlemen... start your engines. 



Trk Set Bytes From 



To 



$16 $0E $B1-B2 49 AA 



A9.55 



Softkey for. , 



Sub-Mission 

by Mindscape 



It was like a challenge from Mindscape. The 
message on the package stated: 

"WARNING: Make a wrong move 
and one of the captives dies and is 
erased from the disk... forever!" 

But on the inside was a petition to the 
"Supreme Commander" who could (for $7.00 
and your original disk) bring the erased captives 
back from the dead. 

What a great niarketing idea this is, a disk 
that tells you it destroys itself. Then for only 
seven bucks a pop you can have all the 
replacements you need. 



Make DOS ignore end marks and 



The Crack 

checksums. 
POKE 474Ze, 24 

L? I Run COPYA from your DOS 

master disk. 

L^ I Make the following sector edits: 

Trk Set Bytes Frorr To 

S05 $0C $23-27 C6 F4 D0 94 38 A9 A0 85 F4 13 
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With these changes the program will boot and 



A.P.T.for.. 



Sub-Mission 

Mlndscapc 



Track $22 sector SOO bytes $00-08 cotitaitis 
your game status. 

You tiave to win at least one game before you 
can play with either of the 'captives'. 
(Remember .. the ones erased from the disk 
forever!). 

The byte patterns are: 

Startup (if you've never won a game) 

0iaiFB2e4^0iei00 

Won one game - no one dead 

0101FF2844010ie0 

Won one game - Sigpurny de^id 

0001FD2B44010100 

Won one game - Peter dead 

0100FD2847ei0100 

So Mindscape... erased forever... 



Softkey for. . 



Facemaker 

spinnaker 



This one was too simple. 

LOAD LOADER 
100 CALL 24610 
SAVE LOADER 



Softkey for... 



Kuttg-Fu Master 

Data East 



l_l I Make DOS ignore end marks and 

checksums. 

POKE 47426, 24 

I ^ I RUN COPYA from your DOS master 
disk. 

I ^ I Make the following sector eilil?:: 

Trk Set Bytes From To 

$00 S05 $24-36 ? C6 50 F0 03 4C IE BF A0 
00 Bl 03 99 00 00 88 D0 
FS 38 60 



You might also want to scan the disk for 
track/sector lists. 

The hi- res banner is on the disk 3 or 4 times, 
with minor modifications. But the best picture 
is never called, except in my version. 



Softkey for.. 



Championship Boxing 

Sierra On-Line 



This disk is CQPK4able as-is, so all we have 
to do i.s take out the nibble/signature check. The 
check lives on track $17, sector 505. 



Trk Set Bytes From 



To 



$17 $0.5 $E3-E5 20 00 ID 



EA EA EA 



Softkey for. , 



Street Sports Basebali 

Epyx 



Write these changes back to the disk and 
enjoy. 



Fred and I cracked this over the phone one 
evening, and thought that you would like to be 
able to back up your copy. 

First of all, the disk is COPK4able, but a 
copy will not run. Therefore, the likely 
protection is a nibble count of some sort. 

Start by scanning the disk for the bytes 
$C08C. These bytes show up in a number of 
places. 

But the code we want to alter resides on track 
$00, sector $05. How did we know that this was 
the code we needed to change? 

Well, normally in DOS after the $CD8C is 
coded there is a search for the bytes D5 AA 95 
or D£ AA are checked. However in this instance 
the bytes searched for were E7 and EE. 

Reading the code reveals that after these odd 
bytes are found then subsequent bytes are stored 
at memory locations $FO-FF. So all we have 
to do is store the bytes read and then jump over 
the nibble count routine. 

So take out your tnisty sector editor and read 
track $00, sector $05. Then starting at byte 
XT 2 1 , {XX = the buffer that you are working 
in) enter: 

Trk Set Bytes From To 

$00 $05 $21 ? A9 FC 85 F0 85 F3 85 F4 
85F5e5F5A9EES5Fl 
85 F2 85 F7 A9 F6 85 F8 
A9 00 85FA85FE85FF 
A9 08 85 F9 A9 FE 35 FB 
A9A0 85FCA9 79 85FD 
4C 7A GB 



That's it. 



MOST 

WANTED 

Softlceys 



ABM Muse 

Accolade Comics Accolade 

Agent U.S.A. Schoiaxtic 

Airheart Erode rbmicf 

Aigeblaatet Davidson & Ajisoiwte.'i 

Apple Super Pilot Appte 

Ballbia^r Epwr 

Balance (}f Pow^r Mitidicapc 

Bojidits Sinus Software 

Bank Street Filer Broderbtnid 

Brain Bank Vie Ohscrviiiory 

Captain Goodnight Broderbufjd 

Car Builder Opitttm Resource 

Championship Baseball Acu vision 

Colossus IV Firebird 

Create with Garfidd OLM 

Cross Clues Science Research 

C™."n*flftf Magic Mindscape 

Crypt of Media Sir Tech 

DB Master V4.& Stoneware 

Deep Space Sir Tech 

Earth Orbiting Station (FOS) Fiecsrimic An 

Fay: The Masked Woman Digitech Sojti^'are 

Fay's Word Rally Di^itech Sojt'\^'ore 

Fay: Word Hunter Di^iicrh Sofnviire 

Fun Bunch Unicorti 

Gemstone Healer SSI 

GoIdFinger Mindscape 

Goifnien l>fiUiKoJ7 

GradeBusters 1-2-3 Grxidebu^tcrs 

Gutenburg Jr, & Sr. Mirrotnation LTD 

Handicapping System Sports Judf^c 

Flardball U (gs) Accolade 

J ^ S Grade Book J -^ S Sofi\^-are 

Jet y 1.0 SKbfogic 

Jigsah! Microjun 

Le Fruncais Par Ordinateur D.C. Heath & Co. 

Mathblaster Davidson & Associates 

Mizrozlne 22 <fe 23 Scholasiic Software 

Mind Mirror Efcci ron ic A rts 

Movie Monster Game Epyx 

Odin Odesut 

Operation Frog Scholastic Sofiware 

Peeping Tom Microiah 

Personal Finance Manager Apple Cvtnputer 

prime Plotter Primesoft Corp. 

I*rint Master Unisiitn World 

Quiz Castie Di^itech Software 

Silent Service H (gn) Microprostf 

Sn oggte Brode rhund 

Stellar 7 Penguin Sofnvare 

Success with Typing VI. 2 SchoUiJitic Sofr^s-are 

Super Factory Sunburst 

Think Tank Uving Video 

Tower of Myraglen H (gs) PBI Software 

Type! Brodcrbund 

Visiblend Microlab 

Where in USA is C. San Diego Brodcrbund 

Work Force H Cor^' Cont-epis 

The Works First Star Softi-v^jn' 

Zorro Datosofi 
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Legends tell of the days when the ancient back issues of Hardcore COMPUTIST were readily available to anyone who wished to purchase them. 
Those days may be long past, but the treasures with those ancient documents has been diligently transcribed to the pages of a modern reference work; 

The Book(s) of Softkeys 



I Ccnnpiled from issues 1-5 

contains softkeys for: •Akalabeth •Ampermagic 'Apple Galaxian "Aztec "Bag of Tricks 'Budge's Trilogy 
•Buzzard Bait •Cannonball Blitz 'Casino 'Data Reporter •Deadline •Disk Organizer 11 "Egbert 11 
Communic. Disk "Hard Hat Mack •Home Accountant •Homeword 'Lancaster •Magic Window II •Multi- 
disk Catalog •Multiplan •Pest Patrol •Prisoner II •Sammy Lightfoot "Screen Writer II •Sneakers "Spy's 
Demise "Starcross "Suspended "Ultima II 'Visifile 'Visiplot "Visitrend "Witness "Wizardry •Zork I •Zork 
II 'Zork III PLUS 'how-to' articles and listings of need-to-bave programs used to make unprotected 

backups. 



Volume II Ccynipiled from issues 6- 1 

contains softkeys for: 'Apple Cider Spider "Apple Logo 'Artist Arcade Machine "Bank Street Writer 
•Cannonball Blitz •Canyon Climber •Caverns of Freitag •Crush, Crumble St Chomp "Data Factory V "DB 
Master "The Dic*tion*ary 'Essential Data Duplicator I & III 'Gold Rush 'Krell Logo 'Legacy of Llylgamyn 
'Mask Of The Sun "Minit Man 'Mouskattack 'Music Construction Set 'Oil's Well "Pandora's Box 
• Robotron 'Sammy Lightfoot "Screeniwriter II v2.2 "Sensible Speller 4, 4c, 4.1c "Spy Strikes Back "Time 
Zone vl.l "Visible Computer: 6502 'Visidex 'Visiterm "Zaxxon •software for: •Hayden •Sierra Online 
I 1 PLUS the ultimate cracking program: Super lOB 1.5 """and more! 



Volume III Camp iled from iss ues 11-15 

contains softkeys for: 'Alien Addition 'Alien Munchies 'Alligator Mix 'Comp. Prep. SAT "Cut & Paste 
•Demolition Division. "DLM software "EA {Electronic Arts) software 'Einstein Compiler 5,3 "Escape From 
Rungistan "Financial Cookbook "Flip Out "Hi-res Computer Golf II 'Knoware 'Laf Pak "Last Gladiator 
•Learning With Leeper •Lion's Share "Master Type 1.7 "MatheMagic 'Minus Mission "Millionaire 'Music 
Construction Set 'One-on-one "Penguin software 'PFS software "The Quest • Rocky 's Boots "Sabotage 
"Seadragon "Sensible Speller 4 'Snooper Troops II •SoftPorn Adventure "Stickybear series "Suicide 
'TellStar 'Tic Tac Show 'Time Is Money "Transylvania •Type Attack •Ultima III Exodus •Zoom Graphics 
'Breaking Locksmith 5.0 Fast Copy I PLUS feature articles on • Csaver • The Core Disk Searcher 
• Modified ROMs. 



Address. 
CitY 



ID#. 



Stale 



'Zip 



Country . 



Phone 



Exp. 



L_l VolumL; 1 - S7.95 
-I- $2 V b ippii r,t|,-7i lui tllii if> 

n Volume II - $12.95 
+ $2 sli ipp ii I ,y /I) tmdih ig 

l_l Vol Lime 111 - $17.93 
■^$2 shijipiiii^/hiindliiiji 

I : All 3 volumes: - $30.00 
-I- $2 sit ipphii^/tutiutihig 



SiynLitLirf^. 



irso 



Fortian orders (except Canada and Mexico) please add S5 for shipping and handling. Washington resldenti add 7.8% sales tax. 
Most orders are shipped within .^ working days, however, please allow 4-6 weeks delivery. l,"S Funds drawn on LS banks only. 

Send to: Book Of ,Softkeys PO Bo\ 110846-T Tacoma. WA 98411 (206) 474-5 



coiwruxisi 



Nott: Sattktys with (t) rei"L*r to Jirections 
in another COMPUTIST issue or is 
incomplete as published in tiits issui?, 



Ft'Muyes: Eliminate some ProDOS 
erroneous srror messages •Date/time without 
a elock card 'Sector surgery: recover lost files 
•Generating Applesoft programs 'on-thedy' 
•Product Monitor reviews *P/.US: Hew to 
convert List Handler files into standard text files 

• How to tnake GRAPHIC,GRABBERv3 run on 
the llgs -Laser I 38 'absolute' RESET •Pkiyiiii^ 
Tips far: Eiard's Tale 11. Conan. Donkey Kong. 
Hacker I, Hard Hat Mack, Ortiitron. Print Shop 
Companion. Spelllireaker, Spy Hunter. Ultima 
4 •/iP.r.s ,/fjc. Infiltrator, Lode Runner, 
Montezuma's Revenge. Swordthrust series 
RDEX Softkt'vs: "Addition Logician •Animate 
•Arcade Boot Camp "Arctic Fox •Bard's Tale 
II "Catn Mouse "Counting Critters •Dam 
Busters T •Destroyer •Draw Pius vl.C 'Dr. 
Ruth's Comp Game Of Good Sex "Echo 1.0 
•E.D.D, 4 "Gamemaker "Hard Ball "Infiltrator 

• List Handler t "Locksmith 6,0 Fastcopy t 
•Magic Slate 'Math Critters •Millionaire 
•Mind Mirror "One On One "Paintworks Plus 
V 1 .0 "Paintworks Plus v ! . I 'PHM Pegasus 
"Portal •Quotient Quest "Reader Ralihit 
•Saunders Chemistry CAI •Science Toolkit 

• Shanghai "Strip Poker ^ "Super Bunny 
"Super Sunday "Swordihrust series T "Term 
Paper Writer "Thief 'Top Fuel Eliminator 
•Typingl t "Up-n-Down "Willy Byte "Writer's 
Choice Elite V 1 .0 "Writing A Character Sketch 
"Writing A Narative 



Fcaiifrc's.-Dungeo'n Editor S 

Encounter Editor for Ultima III "APT for 
Shadowkeep "Softkey for Shadowkcep 
•Softkey for Apple Business Graphics • RDEX 
Sofiki'\s: •SI 6 Paint GS 'Amnesia •Arctic 
Fox "Award Maker Plus "Bard's Tale II 

• Bettcnvorking Word Processor "Beyond 
Castle Wolfenstein "Black Magic "Bookends 
Extended "Bop S Wrestle "Chess 7.0 
•Chessmaster 3000 "Deluxe Paint GS 

• Destroyer "Hacker II "Hacker II GS "Hardball 
"infiltrator "Instant Music GS "J-Bird "Mabel's 
Mansion "Marble Madness "Mean 1 8 GS Golf 
•Megabots "Might S Magic "Miner 3049er 
It "Mouse Word "Music Construction Set GS 
•Music Studio GS "New Oregon Trail 
•Paintworks Plus LOGS 'Paintworks Plus 
1,01 GS •Paul Whitehead Teaches Chess 
"PHM Pegasus "Poetry Express "Print Shop 
color version "Rambo; First Blood part II 
"Rocky Horror Show "Sargon III* 'Shanghai 
GS 'Spindizzy "TelePorter "Temple Of Apshai 
trilogy "Top Draw GS "Transylvania "Ultima 
I 'World's Greatest Baseball Game 



Fi'iituix's: Infocomtext Reader 
Enhancement 'Color Ultimapper mod to 
Ultimapper IV "Towne Mapper utility for 
Ultima IV "Dungeon Mapper utility for Bards 
Tale 'Hardware Corner: Interrupting Your 
Apple •Softkey for Charlie Brown's 1 ,3,3s • 
RDEXSofikey-i: • G u i t a r W i za rd • Gems t on e 
Warrior •Notable Phantom 'Micro Wine 
Companion "Stickybear Printer "Note Card 
Maker 'Starcross •Wishbringer 'Dinosaur Dig 
'Dam Busters 'Pirate Adventure 'Infiltrator 
"MECC software "Banner Catch 'Turtle Tracks 
•PES File "Microzine ji I 3, ff I 3, ,f i 4 "Marble 
Madness "Writer Rabbit "Arcticfox 'Age Of 
Adventure 'Might And Magic "Space Station 
"Alternate Reality 'Mindshadow 'Gemstone 
Warrior 'Strip Poker "Lucifer's Realm 
'Manuscript Manager 'Bank Street Writer III 
'Kids On Keys "The Missing Ring "Graphic 
Solution 'Empire I, II "Championship Golf. 



_ Sofikcys 'Advanced Microsystems 

Technology programs "Word Attack 'Star 
Blazer "Science Toolkit "The Color Enhanced 
Print Shop "Video Vegas 'The Handlers 'K.C 
Deals On Wheels 'Law Of The West -Break 
The Bank Blackjack "Foundation Course In 
Spanish 'OGRt "Puzzles And Posters 
*Fi-tinii-fs "The Shift Key,' Lower Case Option 
For II ^ "Amazing Computer Facts 'Shape 
Magic utility •ccriVir: Multiscribe, , . . . . 



Sofikfys 'Mouse Cale 'Sands of 
Egypt 'Number Farm "Agent U,S.A, "Wavy 
Navy "Kindercomp "Flight Simulator Update 
"Raid over Moscow •Crime Stopper "Key 
Perfect 5. "The Final Conflict 'Miss Mouse 
'Snoggle *E(.'tiiiiirs 'Write Protecting the 
Microsoft RAM Card "Keys to Success on the 
Franklin Ace ".Modified F8 ROMs on the Apple 
,'.'/ *C(»v "Ow'tier's Review of Copy Master II 



Sofikcy.s •Arcade Boot Camp 
•Goonies 'Zorro 'Coveted Mirror "Crimson 
Crown "Compubridge 'Fleet System 3 
'.Microwave 'Escape "Catalyst 3 "Number 
Farm •Alphabet Circus 'Joe Theisman s Pro 
Football "Black Cauldron "Intern, Gran Prix 
*Eeatu>es 'Making DOSIess Utilities 'Pixit 
Printer Drivers •Ri'vik'w: Z-RAM Memory 
Expansion Board "Reading the Joystick. . . 



Softki'ys 'Graphics Expander 

• Information Master "Certificate Maker 'Elite 
'Catalyst 3,0 and i.O "Murder On The 
Mississippi 'Temple Of Apshai Trilogy 'Troll 
Associates programs "Spell It "Regatta "Cdex 
Training programs 'Think Fast •Features 

• How to Write-Protect your Slot Zero 
•Capturing Locksmith 6,0 Fast Copy 
•Revisiting DOS to ProDOS and Back *Q>ir 
•Computer Eyes ,' 2 : a Review 'APIs "Sword 
of Kadash S Rescue Raiders 'Ultimaker IV , 
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Sofikcys 'Light Simulator 'Beach- 
Head "Monty Plays Scrabble "Racter 'Winnie 
the Pooh "Infocom Stuff. Kabul Spy, Prisoner 
II "Wizardry I S 2 "Lucifer's Realm 'The PES 
Series 'Dollars and Sense "Strip Poker 
•Coveted Mirror "Wizard's Crown "The 
Swordthrijst Series "Axis Assassin "Manuscript 
Manager "The Crown of Arthain "Address 
Book "Decimals 3.0 'Dragonfire •Fcanin's 
•Auto Duel Editor 'Wizard's Crown Editor 
•Questron Mapper •Core 'The Games of 
1986 in Review •Adveiinire Tips 'Ultima IV 

^K 1 Softkeys "The Periodic Table 
•Gemstone Warrior "Inferno 'Frogger "Story 
Maker 'Adventure Writer "Mummy's Curse 
•Zaxxon •The Quest "Pitfall II •H,E,R,0. 

•FctiUires 'A Two-Drive Patch for Winter 
Games "Customizing the Speed of a Duodisk 
"Roll the Presses Part Two: Printshop Printer 
Drivers "The Games of I986.s v%-i«xifi ;• 



40 



Sofikeys "Adventure Writer 'E-Z 

Learner 'My chess 11 'Raster Blaster "Cranston 
.Manor "Ghostbusters 'Designer's Pencil •The 
American Challenge "Encyclopedia Britannica 
Programs "Crime Wave Feaiiircs "Taking the 
Wiz out of Wizardry 'Adding a Printer Card 
Driver to Newsroom •C^jct'^Gairies of I9fi6 



Sofikcys '.MIDI'S + 'Homeword 
v3. 1 'Borrowed Time "Amazon "Speed Reader 
][ 'Discovery! 'M-ss-ng L-nks series "Donald 
Ducks's Playground 'Mastering the SAT 
"Copy II Plus 4.4C 'Master of the Lamps "One 
on One "Bridge Baron "A.E. 'Great American 
Crosscountry Road Race 'Computer 
Preparation for the SAT 'Castle Wolfenstein 
'Luscher Profile "Skyfox 'Silent Service "Echo 
Plus 'Swashbuckler 'Randamn •FeuUires 
"Electronic Disk Drive Swapper 'Abusing the 
Epilogues 'Print Shop Companion's Driver 
Game •Con' 'Keyboard Repair "Fixing the 
Applesoft Sample Disk , . . , , . .:. -.-i.,- 



_ Safikexs 'Cyclod "Alternate 

Realty "Boulder Dash I S II 'Hard Hat Mack 
(Revisited) "The Other Side "F- 1 5 Strike Eagle 
•Championship Lode Runner "Gato V 1 ,3 'I. 
Damiano "Wilderness "Golf's Best •Feonires 
•The Enhanced,' Unenhanced ,'.'e "Looking itito 
Flight Simulator's DOS •Core "Appavarex 
"Installing a RAM disk into DOS 3.3. ,,:, 



Sefikeys "Under Fire "Pegasus || 

'Take I (revisited) "Flight Simulator II v I 05 
(part 3) 'Magic Slate •Alter Ego •Rendezvous 
"Quicken "Story Tree 'Assembly Language 
Tutor 'Avalon Hill games "Dark Crystal 
•Features "Playing Karateka on a /,'c "Track 
Finder "Sylk to Dif *Core "Breaking In: tips 
for beginners "Copy ][ Plus &.0\ a review "The 
DOS Alterer 



December 



Ai^ailable Back Issues 



Softki'yx "Flight Simulator II v 
1 .05 •AutoDtid •Critical Reading 'Troirs Tale 
•Robot War •General Manager •Piasmania 
"Telarium Software "Kidwriter v 1 .0 'Color Me 
'Fi'dUinv "ScreenWriter meets Flaslicard •The 
Bus Monitor 'Mousepaint tor non-Apples 
• Ci'ir "The Bard's Dressitig Room *APT 
•Championship Lode Runner- luiaj ^s:3: e 



Sopki'ys * Millionaire • SSI's 
RDOS • Fantavision • Spy vs. Spy • 
Dragonworld • Kings Quest • Mastering the 
SAT • Easy as ABC • Space Shuttle • The 
Factory • Visidex LIE* Sherlock Holmes • 
The Bards Tale • Heaiurc • Increasing Vonr 
Disk Capacity • Con: • Ultimaker IV. an 
Ultima IV Character Editor.-;,, lss,, ...-s:s;,i i.*. 



Sofikt'vs * Electronic Aits softwai'e 

• Grolier software • Xyphus • F- 1 5 Strike Eagle 

• Injured Engine • Mr. Robot And His Robot 
Factory • Applecillin II • Alphabet Zoo • 
Fathoms 40 • Story Maker • Early Games 
Matchmaker • Robots Of Dawn • Feaiun- * 
Essential Data Duplicator copy parms • Core 
•DOS-Direct Sector Access ^, >. is,, .t 



Sf>fiki'\\<i •Olymbpic Decathlon 
•Hi-res Cribbage •Revisiting F- 1 5 Strike Eagie 
•Masquerade "The Hobbit "Pooyan 'The 
Perfect Score 'Ahce in Wonderland 'The 
Money Manager •Good Thinking 'Rescue 
Raiders 'Feature: Putting a New F8 on Your 
Language Card 'Care 'Exploring ProDOS by 
instaling a CPS Clock Driver, ,,„,.... ,.,„,„ 



Sn ft keys 'Crisis Mountain 
•Terripin Logo •Apple Logo II 'Fishies 1.0 
•SpellWorks 'Gumball 'Rescue at Rigel 
'Crazey Mazey "Conan 'Perry Mason: The 
Case of the Mandarin Murder 'Koronis Rift 
'Feature 'More ROM Running *C<>re 
f*lnfocom Revealed > - « isss-^i rs^^ tss4ii *».;« 



Siiftki'xs 'Word Juggler •TinkI 
Tonk! 'Sundog \1.0 'G.l. Joe S Lucas film's 
Eidolon •Summer Games II 'Thief •Instant 
Pascal •World's Greatest Football Game 
'Graphic Adventure S I 'Sensible Grammar & 
Extended Bookends 'Chipwits •Hardball 
•King's Quest II 'The World's Greatest Baseball 
Game 'Femttre •How to be the Sound .Master 
*Core •The Mapping of Ultima IV 



Sofrkeys "Revisiting Music 
Construction Set 'Cubit •Baudville Software 
•Hartley Software 'Bridge 'Early Games for 
Voung Children 'Tawala's Last Redoubt 'Print 
Shop Companion 'Kracking Vol II •Moebius 
'Mouse Budget. Mouse Word & Mouse Desk 
•Adventure Construction Set •Fetitwe 'Using 
Data Disks With Microzines 'Core 'Super lOB 
vl.5 a Reprint. . , ^,.,,^^ ,^^,,, ^^^,., ^.^.^ .,^^^. 



^9 1 Softkeys •Trivia Fever "The 
Original Boston Computer Diet 'Lifesaver 
'Synergistic Software 'Blazing Paddles 
'Zardax 'Time Zone 'Tycoon •Earthly 
Delights 'Jingle Disk 'Crystal Caverns 'Karate 
Champ 'Feature 'A Little Help With The 
Bard's Tale »Ctiie 'Black Box 'Unrestricted 
Ampersand . . ^- , .,.. ,.,.,.. 



Sisflkeys ' Threshold • Checkers 
v}. I ' Microtype ' Gen. ;§ Organic Chemistry 
Series • Uptown Trivia ' Murder by the Dozen 
• Windham's Classics • Batter Up • Evelyn 
Wood's Dynamic Reader • Jenny of the Prairie 
' Learn About Sounds in Reading • Winter 
Games ' Fctimrc ' Customizing the Monitor 
by Adding 65C0^ Disassembly ' Cafe ' The 
Animator ..,;,._ j , . 



Siifrkeys • Llltima IV • Robot 
Odyssey ' Retidezvous • Word Attack S 
Classmate • Three from Mindscape • 
Alphabetic Keyboarding • Hacker • Disk 
Director • Lode Runner • MIDI/4 • Algebra 
Series • Time is Money • Pitstop II • Apventure 
to Atlantis • Feature • Capturing the Hidden 
Archon Editor • Ct/re • Fingerprint Plus: A 
Review • Beneath Beyond Castle Wolfenstein 

(part 2). . , ,« , ,.5;,, f;s-,..;.,:, ,.-,., ,.-.,i„ ^,. 



Softkeys • Microzines I -5 • 
Microzines 7 -9 Microzines (alternate method) 
• Phi Beta Filer ' Sword of Kadash • Another 
Miner 2049er ' Learning With Fuzzywomp • 
Bookends • Apple Logo II ' Murder on the 
Zinderneut ' Features • Daleks: Exploring 
Artifcial Intelligence ' Making 33K or I 6K 
Slave Disks ' Core ' The Games of (985: part 






Sopkcys • Cannonbal! Blitz • 
Instant Recall • Gessler Spanish Software • 
More Stickybears • Financial Cookbook ' 
Super Zaxxon ' Wizardry • Preschool Fun ' 
Holy Grail • Inca • I 28K Zaxxon • Fealiiri' 
• ProEdii • 0>re • Games ot 1985 part I 



Softkeys * DB Master 4.3 • 
Business Writer • Barron s Computer SAT • 
Take I • Bank Street Speller • Where In The 
World Is Carmen Sandiego ' Bank Street Writer 
I38K ' Word Challenge ' Spy's Demise ' 
Mind Prober ' BCs Quest For Tires ' Early 
Games • Homcword Speller ' Feature ' 
Adding IF THEN ELSE To Applesoft • Core ' 
DOS To ProDOS And Back. .. . . .; . ,, ,,,: 



Softkeys • Choplifter ' Mufplot ' 
Flashcalc • Karatcka • Newsroom ' E-Z Draw' 
' Gato ' Dino Eggs ' Pinball Construction Set 
' TAC ' The Print Shop: Graphics Library • 
Death In The Caribbean ' Features ' Using 
A.R.D. To Softkey Mars Cars • How To Be The 
Writemaster ' Core * Wheel Of Money 



Sofkews ' Miner 204 9er ' Lode 
Runner • A^-PBl' Pinball ' The Heist ' Old 
ironsides • Grandma's House • In Search of 
the Most Amazing Thing ' Morloc's Tower • 
Marauder • Sargon III • Features ' 
Customized Drive Speed Control • Super lOB 
version I.S • Core ' The Macro System. 



Softkeys • Sargon III • Wizardry: 
Proving Grounds of the Mad Overlord and 
Knight of Diamonds ' The Report Card V I . I 
' Kidwriter ' Feaiure ' Apple || Boot ROM 
Disassembly • Core • The Graphic Grabber 
\i.O ' Copy 11+ 5.0: A Review • The Know- 
Drive: A Hardware Evaluation ' An Improved 
BASIC/Binary Combo, . . , k,,, ...,,j-,. ,;,;,, , . . 

1 £v Softkeys • Rendezvous With 
Rama ' Peachtree's Back To Basics Accounting 
System ' HSD Statistics Series • Arithmetickle 

• Arithmekicks and Early Games for Children 

• Features ' Double Your RO,M Space ' 
Towards a Better F8 ROM • The Nibbler: A 
Utility Program to Examine Raw Nibbles From 
Disk • Ctire ' The Games of I ;?84: In Review- 
part II. . , ,,,,«. ^,.,^. ,;.,. ;; ,,. ,,.,.,,... 



Softkeys • Sensible Speller for 
ProDOS ' Sideways • Rescue Raiders • Sheila 
' Basic Building Blocks ' Artsci Programs ' 
Crossfire • Feature ' Secret Weapon: 
RAMcard • Core ' The Controller Writer • 
A Fix For Tiie Beyond Castle Wolfenstein 
Softkey • The Lone Catalog Arranger 
Pan I 



1 Softkeys • Data Reporter ' Multiplan 
' Zork • Features • PARMS for Copy II Plus 
' No More Bugs • APT's for Choplifter 6 
Cannonball Blitz • 'CopyeanI' Revteivs ' 
Replay • Crackshot • Snapshot • Wildcard 
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Softwarf Package 



I + 



[Igs 



Software Package 



ri + 



Ilgs 



816 Paint S45.89 H $45.1 

Airheart 524.98 G 

Award Maker Plus S24.8() '3 

Bank Street Writer 64K S46.8B _ 

Bank Street Speller S^S.BB U 

Bank Street Mailer 64K S46.e8 D 

Bank Street Filer 64K S46.lt8 D 

Bank Street Writer Plus (12aK}. S46.B8 D 

Bank Street Mailer 128K $46.88 D 

Bank Street Filer 128K $46.88 G 

Beagle Graphics $35.88 D 

Beyond Zork S27.89 '1 

Black Cauldron $27.88 3 

Captain Goodnight $24.88 -J 

Championship Karate 314,88 _ 

Clip Art Galiery (lor Paintworks Plus) S2B.8B 

Copy II Plus S23.B8 

Dazzle Draw S48.8B 

Defender of the Crown S32.99 

Destroyer S25.BB 

DiskQuirk SIB.BB 

Draw Plus $52.88 

F-15 Strike Eagle $24.88 

Fantavision $34.88 

FUght Simulator U 336.88 

Gamemaker $34.88 

GPLE $29.58 

The Graphics Studio 342.88 

Gunship. - $27.88 

Hacker II SZ5.e» 

Hardball S22.flB 

Hitchhiker's Guide SZ8.BB 

Infiltrator II S29.BB 

Jet $29-88 

Karateka $24.88 

King's Quest II $32.88 

Knight of Diamonds $23.88 

Labrinth 328.88 

Legacy of Llylgamyn $26.88 

Loderunner - $24.88 



Macroworks 

Math Blaster 

Math Rahbit 

Mean 18, Ultimate Golf. 

Merlin ProDOS 

Might & Magic 

Millionaire II 

Mousewrite 

Muitiscribe 

Music Studio 



328.88 

. 328.88 
. $27.B1 
. $28.BB 
. S66.88 
. $32.88 
. $33.88 
. $99.88 
$45.88 
. 352.88 



327.88 n 



S4fl.88 



$38.88 D 
$28.88 D 



332.88 



D 

D 

D 

D 

D 

D 

D 399.88 Z 

3 366.88 li 

II 



Portal 339. 

The Print Shop 334 

Print Shop Companion S27 

Print Shop Graphics Library: 

Disk One S16. 

Disk Two $16 

Disk Three $16 

Pro-Byter $28 

Racter $38 



Reader Rahhit . . 
Rescue Raiders.. 
Rocky 's Boots . . . 
Science Tool Kit: 
SDI 



Master Module. 



. 327 
. S23 

$34 
. $46 

$32 



Shanghai S24 

Silent Service $23 

Solo Flight $23 

Space Quest $32 

Star Trek- The Kobayashi Alternative $27. 

Star Trek II- The Promethean Prophecy $27 

Sticky bear Series: 

ABC's S24.' 

Math I S24. 

Math II S24.' 

Numbers $24 



Reading 

Shapes 

Typing 

WriUr 

Sub Battle Simtilator 

Sub Mission 

Summer Games 

Super Macroworks 

Tass Times in Tonetown . 
The Towei oi Myraglen. 

Thexder 

Topdraw 

Type. 



$24. 

S24. 

324. 
. $24. 
. S25 
.$27 
.314 
. $38 
. S24. 
.$32 
. S23 

S66 
. S38 



Typing Tutor IV - $32.89 I 

318.99 

353.99 

S26.S8 

$39.88 : 

$25.99 I 

$32, 

328. 

$95 

$25 



Paintworks Plus 352.88 G 



Video Vegas 

Visualiaer - 

Where in USA is Carmen San Diego 

Where in World i« Carmen San Diego 

Winter Games 

Wizardy 

Word Attack 

WordPerfect vtt Spelling Checker- 

World Games 

Writer's Choice Elite $68 

Writer Rabbit S24 

Zork Trilogy $46 



$49-88 G 



S34.88 G 

$39.99 3 
$32.BB G 



327.99 G 
$24.88 G 

332,88 G 
359.88 J 

327,88 D 



S95-98 G 
$27,89 J 



Name _ 



.iiLddi'css 
Citv 



Country _ 
Signature_ 



_ID#_ 



State 



Zip 



_ Phone _ 



Exp. 



CP50 



• Cost of 
Software 
SUBTOTAL 

• Plus 
SHIPPING 

• Plus 
(in WA) 
Sales TAX 



TOTAL 
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Do Tour 

Holiday Shopping 
Now 

Check our 
LOW 

software prices 
for Appie II SC 
llgs software 



How To Order 



• US orders: Check the appropriate box for youi selection. 
For Apple Ilgs software, check the appropriate box in the 
right-hand column. 

• Please add $3 per order for shipping & handling. Orders 
over $200 receive free shipping. 

• Most orders shipped UPS, so use your street address 

• Washington state, please add 7,8% sales tax. 

• Offer good vifhile supplies last. 

• All products are for the Apple II systems unless 
otherwise specified. 

• Foreign Orders: Please inquire as to appropriate 
shipping fees. 



"K APPLE COMPATIBLES 3" 

^LOWEST PRICES ANYWHERE!^ 

IMEG/80 COL 80 W/256K+ Soft ware (Me) . . S99 

IMEG RAM BD tor IIGS w/256K $89 

Above W/512K add J39. 1 MEG add $99 
64K/80 COL BD. New Lower Power (lie! $35 

16K RAM Board (11+) $35 

12eK RAM BD. New Lower Power (11+) $69 

80 Column Board Videx Comp (11 + ) $49 

Super Serial Board (ll+/e| $49 

Graphic Par BDw/6FT CBL'( 11+/ e/gs) $45 

280 CP/M BD Microsoft Comp (+/e/gs) $38 

Cooling Fan w/surge protect (ll+/e) $29 

GS Super Cooling fan (Ilgs) S25 

Numenc Keypad, 16 Keys (lie) $35 

Joystick (Specify ll+/c/e/gs) $15 

JoysSick w/FJre on slick (*/c/e/gs| $25 

Mini Vacuum Cleaner w/ Attachments $10 

A/B Switchbox Parallel or RS-232 $29 

Disk Drive H/H (Specify ll+/c/e/gs) $129 

Disk Controller Board (lt*/e/gs) J39 

Eprom Programmer (ll*/e/gs) $49 



ONE YEAfl WARflANTV ON ALL PRODUCTS 
CALL/WRITE FOR COMPLETE LIST 

ADD $3 SHIPPING (Per OROER, not per Hem) 



NEXO DISTRIBUTION 

914 East 8th StfMt, Suite 109 

National City, CA 92050 

(619) 474-3328 10«m-6pm Mon-Frl 

^ UNIV A SCHOOL P.O.'t WELCOME! A 
W VISA/MC OKAY— CO-D. ADD $2.00 ^ 



Send orders to: 



Softkey Publishing 

PC Box 110816-T 

Tacoma, WA 98411 

(206) 474—5750 



A Hackers Challenge 

awaits those who eiyoj "breaking" protect iun sthenics for fun. 

Knowledgeable with DOS 3.3 
and associated utilities? 

If so, this game is for you. Includes graphics routines 
from The Graphics Magician® by Polarware™. 

Inside, protected by layers of graphical puzzles and 
DOS-tricks hides a secret. Being among the 1 st ten 
to discover the game secret wins you a computer- 
game prize! What are these prizes? I'm not saying, 
yet all the clues you need to win along with the prize- 
list are concealed in the game. 

Find the dues by playing the game. 

Find the clues by using your favorite utilities. 

To answer this challenge send $10.00 to; 

Mark V. Whitehurst 

PO Box 485 

Franklin Park, IL 60131 

Requires APPLK lie or lie. 
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COMPUTIST BACK ISSUES ORDER FORM 



Are 
piece 



Issue lUag Disk Both 

ii.l5 $9.95 S12.96 

43 □ □ □ 

48 □ □ D 

a? n □ □ 

46 LH □ □ 

45 □ □ □ 

44 LI! □ □ 

43 □ □ □ 

42 □ □ □ 

41 □ □ □ 

40 LH □ □ 

39 □ □ O 

38 □ □ □ 

37 □ □ □ 

36 □ □ □ 

35 n □ □ 

34 □ □ □ 

33 □ □ □ 

3Z □ □ □ 

31. □ □ □ 

30 □ n n 

23 Ln n □ 

28 □ □ □ 

27 □ □ □ 

26 □ □ □ 

2S □ □ □ 

24 □ □ □ 

* 23 □ □ □ 

22 □ □ □ 

19 □ □ □ 

16 □ □ □ 

* 7 .' . □ U □ 

Core 2 □ □ □ 

1 □ n o 

Core 1 □ U □ 

Computing 3 .... D • • 

Best of Hardcofe Computing,, • EH • 

Core Special Combo $10 i i 

(All thre^ CORE magazines) 

SomedisksapplytomwethanoneissueajidareshowtiastallerbDxes. 
Special "BDih" flisjL & TTi^azine CDmbmaEion arqterg apply \o gn& issue 
and ils corresponding riis^. 
■*■ We have a limited suppiy of these issues. 

* BacI* issue is no ionger avaitable 



you still missing 

of the picture ???!!! 

back issues and library disks are 
frequently referenced in current issues. 



Back Issues and Library Disk Rates 



• US, Canada and Mexico back issue rate - $4.75 each. 

• All other Foreign back issue rate - $8.75 each. 

• US, Canada, Mexico library disk rate - $9.95 each. 

• All other Foreign library disk rate - $11,94 each, 

• "Both" disk and magazine rates for: 

US, Canada & Mexico - $12.95 each combination. 
All other Foreign - $18.95 each combination. 

A library disk is a di.sicette tliat contains programs that would normally have to be entered by 
the user. Documentation for each library disk can be found in the corresponding issue. 

• Library di.sks are available for all issues of COMPUTIST if I thru 45. A description of the 
softkeys and programs covered in each issue is available upon request. Please send your name 
and address along with a first class postage stamp (US $ .22). 

C&mf>£e£e IJgioi Ca££eclumf 

^^CVKC^C ^t Gomes I constructing Your Own Joystick* Compiling Games* CAMEREt^l^EU'S: 

Over aOohlie latest and best* Picl< Of The Pack; Alkime TOP 20 games* Destructive Forces" EAMON* Graphics Magician 

and GraFORTH* Dragon Dungeon 



CORE 2 

Find* Quiclt Copy' Copv*- 



UtilitCSI Dyhamic Meru* High Res:.Scfoll Derrio* GOTO Label: Replace* Line 



1 CjfSphiCS: Mernory Map* Tsxt Graphics: Marquee* Boxes* Jagged Scroller* Low 
Fles: Color Character Chart* High Res: Screen Cruncher* The UFO Factory* Color* Vector Graphics: Shimmering Shapes* 
A Shape Table Mini-Editor- Block Graphics: Arcade Quality Graphir;s for BASIC Programmers' Animation 



Hardcore Computing 3 

Review of Sit Copiers* Boot Code Tracing* S 



HyperDOS Creator- Menu Hello- Zyphyr Wars* Vector Graphics* 

Softkey I08* interview with 'Mike' Markkula. . . .-.::; ^^■. ,-. . .^■.■;-. ^ .:.. .:iyv^rT. 



D Please send the back issues indicated: 



D Piease send the following library disks: 



Name_ 



_ID#_ 



Address _ 

City 

Country _ 

Signature . 



State 



Zip 



Phone 



Exp: 



.CP50 



US funds drawn on US banks 



Send check or money order to: 

COMPUTIST 

PO Box 110B46-T 

Tacoma, WA 98411 

(206) 474-5750 

Most orders are shipped within 5 working days, however please allow up 
to <l weeks delivery for some orders. Most orders shipped UPS, so please 
use street address. Offer good while supply lasts, in Washington state, 
add 7.8% sales tax. 
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COMPUTIST's... 




No 'Input' or 'Readers 
Softkey & Copy Exchange' 

The old INPUT and the READERS 
SOFTKEY AND COPY EXCHANGE 
columns have now been combined into the 
new Readers Daia Exchange (or RDEX, 
pronounced AR-DEX). 

All soft keys, comments, articles. 
questions, answers, fixes and bugs and 
almost any other inh)rmation that rnusi be 
printed in a limeiy fashion will be placed in 
RDEX. 

Although we will print letters and article- 
softkey submissions that are received as only 
printed text, we would prefer that they be- 
submitted on disk. 

We no longer purchase 
articles or softkeys 

That's righL The author's 'by-line* is the 
only payment offered to COMPUTIST 
writers who get published. Even the staff is 
composed of unpaid volunteers. 

Of course, COMPUTiST reserves the 
right to edit and publish ANY contribution 
(whether submitted as a lettcr-to-the-cditor 
or article- softkey) in the RDEX section. 

All published contributions become the 
property (and are copyrighted as part) of 
COMPUTIST magazine. 

How to get your name on 
RDEX contributors list 

Whether you are contributing data to 
RDEX or just asking a question, we urge 
you to follow these writer's guidelines. 

D All contributions and submissions 
should be submitted in both printed 
format and on disk, 

n Your printout must use only one side 
of the paper. 

U Text should be double-spaced using a 
no n -compressed font with both upper 
and lower case. 

D A letter quality mode is preferred, with 
each page torn at the perforation only . 
Pages need not be stapled together. 



C the first page should contain the 
following data; 

TITLE OF WORK 

FULL NAME OF AUl HOR 

ADDRESS 

PHONE NIIMBER 

iJi Each page of the manuscript and 
program listing should include the 
author's name, the title of the work, 
and the page number in the upper right 
hand corner. 



A standard text file on a 
DOS 3.3 5V4" floppy disk 

The article and any accompanying 
program should be subtnitted as a standurd 
text file on a DOS 3,3 disk. Label the disk 
with the title of the work and the author's 
full name and address. 

ON DISK, TEXT MUS T BE SINGLE- 
SPACED ONLY. Please identify your 
editing program. 

We always tty to return your chsks as soon 
as possible. Still, to protect ourselves, we 
must say that we are not responsible for 
unreturned submissions. 

Here's how best to 'talk' 
to COMPUTIST readers 

A. Always assume that your reader is a 
novice and explain all bu/.zwords and 
technical jargon. Pay .special attention to 
grammar and puncluation. we require 
technical competence and good, readable 
style. 

B. A list of hardware and software 
Requirements should be included at the 
beginnmg oi the manuscript. When 
published, this list will be offset from the 
main text. 

C. Include the manufacturer's or publisher's 
name when a commercial program or 
product is mentioned, 

D . When submitting y ou r own prog rarhs , 
first introduce the purpose of the program 
and features of special interest. Include 
background information describing its use. 

Tips for advanced uses, program 



modifications, and utilities can also be 
included. Avoid long print statements and 
use TABs instead of spaces. 

Remeniher: A beginner should be able to 
type the program with ease. A program will 
not accepted for publication without an 
accompanying article. 

These articles, as well as articles on 
hardware and DOS modifications MUST 
summarize the action of the main routines 
and include a fully remarked listing. 

F, GENERAL ARTICLES may include 
advanced tips, tutorials, and explorations of 
a particular aspect of Apple computing. 

G. SOFTKEYS must contain detailed step- 
by -step procedures. Number each step 

For each softkey, first introduce the 
locking technique used and then give precise 
steps to unlock the copy -protected program. 



Please do NOT send any 
original commercial disks 

We accept articles which explain locking 
techniques used in several programs 

published by the .same company. 

H. APTs or ADVANCED PLAYING 
TECHNIQUES can deal with alterations to 
a program, deleting annoying sounds. 
acquiring more points in play and avoiding 
hazards. 

Again, provide step-by -step instructions 
to complete each APT and explain each 
step's function. 

Please mail all letters, short articles and 
softkeys to the RDEX Editor. When accepted 
for publication, they will be 
IMMEDIATELY edited, typeset and 
entered into the next RDEX. 

Remember that we cannot purchase these 
contributions. 

RDEXed 

PO Box 110846-T 

Tacoma, WA 98411 



December 



COMPUTIST #50 



The Hacker'i Ullimaie Copy t Deprolection Utility 

Siipiif lOB Collection ! 



ALL of our Super lOB controllers (through 1986) in 'ONE' package! 



COMPUTIST developed the ultimate copy program to 
remove copy protection from software; 

The Super lOB program. 

Since the introduction of Super (OB, COMPUTIST has 
used this flexible program to deprotect (or partially 
deprotect) dozens of commercial programs with far 
ranging protection schemes. 

Super lOB deprotects disks by using a modified RWTS 
(the subroutme in DOS wtiich is responsible for the 
reading and wnting of disk sectors) for reading from the 
protected disk and then using a normal RWTS for writing 
to the deprotected disk. 

This package contains: 

*- TWO DISKS (supplied m DOS 3.3). Each disk contains at 
least 60 Super lOB Controllers including the standard, swap, 
newswap and fast controllers. Also included is version 1 .5 of 
Super lOB. the Csaver program from COMPUTIST No. 1 3, and 
a Menu Hello Program that lists the available controllers and, 
when you select one, automatically installs it in Super lOB and 
RUNS the resulting program ' 

>■ A reprint of Disk Inspection and the Use of Super lOB, 

from COMPUTIST No 17 This article explains how to wrte 
your ov!/n Super lOB controllers. 

»► COiyiPUTIST No. 32, which contains an extensive articlB 
detailing the hows and whys of Super JOB v1.5 and at least 
5 atttcles using the new Super lOB program. 

• Several of the controllers deprotect the software 
completely with no further steps. This means that some 
programs are only minutes away from deprotection (with 
virtually no typing). 

• The issue of COMPUTIST in which each controller 
appeared is indicated in case further steps are required to 
deprotect a particular program * * 



■ Yes, please send me The Super lOB Collection 

Includes both disks with Super lOB version I .S, 
CC3MPUT1ST #32, PLUS a reprint of "Disk Inspection and 
the Use of Super lOB". 

D US/Canada/lVIexico for $16.00 
H Oftier Foreign for $20.00 

Send lo: Super I OB Collection 

PO Box 110846-T Tacoma, WA 98411 

or call: (206) 474-5750 for S or W orders. 

* Requires al I east 64K of memory. 

** Although some controllers will completely deprijtecl the program 
they were designed fur, some will not, and therefore require their 
eorresponding issLie of COMPUTIST to complete the deprotei;tion 

procedure. 



Name_ 



Address 
City _ 



Country _ 



Signature 



The SUPER lOB Collection 

Voiume 1 of the Super tOB colleChoi^ covers all the controllers 
from COMPUTIST No 9 through No 26 Also ineludsd are the 
newswap and fast ooritrollers from COMPUTIST No 32, Tiie foliov<ing 

60 controllers ara on volume 1 
Advancad BlacKiar.K, Alptiabet Zoo Arcaae Machine. Archon II 
Archon, Artsci Soflwafe, Bank Street Writei, Barrons SAT, 

Beyond Castle WoSfenslein. BSW lio Loader, Castle 
Wolfensiem, Computer Prepgralion SAT, Dazzle Draw DB 

Master 4 Plus Death m (he Carntean. Dmo Eggs. DLU 

SoHware Electronic Arts F-iS Sirilte Eagle. Fast Controller 

Faitoms 40. Financial CoctkbooK, Gessier Software. Grandma s 

House. The Haist Ir Search of the (ulost Amazing Thing. Instani 

Recall. Kidwnter, Lions Share, Lode Runner, Mastertype. Match 

MaKei.. Miner 2049ei Mmit Man, Mufpioi, Newsroom, Newswap 

controller. Penguin Soflwafe Pfint Shop Graphic Litjrary, Print 

Shop, Rendesvous with Rama Rockys' Boots, Sargon II! Sea 

Dragon Shieia, SfiytoK Snooper Troops, Standard controller, 

Staneware Softwere, Summer Games, Super Controller, Super 

Zaxxon, Swap Controller, TAC, Ultima I II, Word Challenge. 

Xyphus. Zaxxon 

Volume 2 of tna super lOB collection covers all the controllers 

Ifom COMPUTIST No. 27 through No. 38 The fcllowing 65 controllers 

are on volume 2 

Alice in Wonderland, Alphabatic Keyboarding. Alternate Realily 

Autociuel Cheoliars, Chipwits, Ctllor Me, Conan.data, 

Conan prog CopyDOS, Crisis Moun[ain, Dish Director. 

Dragonworid, Early Games Easy as ABC, F-1S Strike Eagle, 

Famavi-sion Fasi controller, Fishies, Fiighi Simulator, Haiiey 

Project, Hartley Soflwara (a). Hartley Sollware (bi, Jenny o( fhs 

Prarie, Jmgls OiSK, Kidwritei, Kracking Vol li. Lode Runner, 

LOGO II (ai. LOGO It 0). Masquarade. Mastering the SAT 

MicrQIype The Wonderlu) World of Paws, Microzines 1 

Microzines 2-5. Mmer 2049er, Mist ft View to a Kill, Murdor on 

the Zinderneuf, Musk Construction Sst Newswap controller. 

Olympic Decathlon Other Side. Phi Beta Filer Pitstop ir. Prim. 

Shop Companion, RDO-S. Robo! War. Spy vs Spy, Standard 

controller, Sundog VS Swap controller. Sword of Kadash, 

Synergistic Software, Tawalas last Redoubt, Terripin Logo, 

Threshold. Time is Money Tme Zone. Tink' TonkI, Troll's Tale 

Uliima IV, Wilderness Word Attack S Classmate. World's 

Greatest Baseball, World's Greatest Football 



..ID#_ 



State 



Zip 



Phone 



. Exp. . 
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Most orders are shipped within 5 working days, however, please allow 
4 to 6 weeks for delivery. Washington residents, please add 7,8% sales tas. 

US fundis drawn on US banks 



COMPUTIST 50 



December 



